Kerberos аутентификациясы

#1 2026-09-29 20:34:11

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

TERMSRV/sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: TERMSRV/sp.socpedia.net
Type: 1
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#2 2026-09-29 20:34:11

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: sp.socpedia.net
Type: 1
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#3 2026-09-29 20:34:11

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

{28bfc32f-10f6-4738-98d1-1ac061df716a}:target=sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: {28bfc32f-10f6-4738-98d1-1ac061df716a}:target=sp.socpedia.net
Type: 6
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#4 2026-09-29 20:34:11

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

TERMSRV/sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: TERMSRV/sp.socpedia.net
Type: 2
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#5 2026-09-29 20:34:11

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: sp.socpedia.net
Type: 2
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#6 2026-09-29 20:34:12

Listener RDP-Tcp received a connection (261 "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational")

192.168.0.225

SP.socpedia.net

Listener Name

RDP-Tcp

Listener Name: RDP-Tcp
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 1076
ThreadID: 1988

#7 2026-09-29 20:34:12

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

TERMSRV/sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: TERMSRV/sp.socpedia.net
Type: 1
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3280

#8 2026-09-29 20:34:12

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

{28bfc32f-10f6-4738-98d1-1ac061df716a}:target=sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: {28bfc32f-10f6-4738-98d1-1ac061df716a}:target=sp.socpedia.net
Type: 6
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3280

#9 2026-09-29 20:34:12

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: sp.socpedia.net
Type: 2
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3280

#10 2026-09-29 20:34:12

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

TERMSRV/sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: TERMSRV/sp.socpedia.net
Type: 2
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3280

#11 2026-09-29 20:34:12

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: sp.socpedia.net
Type: 1
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3280

#12 2026-09-29 20:34:12

A new process has been created (4688 "Security")

192.168.0.231

ws2025.socpedia.net

WS2025$

Process Information: Process Command Line

"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: WS2025$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0x11c8594a
Process Information: New Process ID: 0x84c
Process Information: Creator Process ID: 0x3e0
Process Information: New Process Name: C:\Windows\System32\CredentialUIBroker.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8202
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 4740

#13 2026-09-29 20:34:12

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

SOCPEDIA\localadmin

Command Line

"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding

Command Line: "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding
Image: C:\Windows\System32\CredentialUIBroker.exe
Process GUID: {93585ce4-da74-6abb-4d33-000000001800}
Current Directory: C:\WINDOWS\system32\
Original File Name: CredentialUIBroker.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {93585ce4-288c-6aaa-0d00-000000001800}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=96BD4814912330AE2B72ABB7471759AA824C425B,SHA256=EA27C635CD810797D73F6F3AA57A166F77520DE7B46780E9D0FB749394FC9812,IMPHASH=CA5E4300F6ED0DA2C100D8C93121C4BC
Logon GUID: {93585ce4-c7b4-6abb-4a59-c81100000000}
Logon ID: 0x11c8594a
Integrity Level: Medium
Process ID: 2124
Parent Process ID: 992
Terminal Session ID: 7
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 2392

#14 2026-09-29 20:34:12

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210

DC.socpedia.net

NT AUTHORITY\NETWORK SERVICE

Image

C:\Windows\System32\wbem\WmiPrvSE.exe

Image: C:\Windows\System32\wbem\WmiPrvSE.exe
Process GUID: {d062d9b1-d9da-6abb-f72b-000000000b00}
Process ID: 6824
User: NT AUTHORITY\NETWORK SERVICE
UTC Time: 2026-09-29 15:34:12.592
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 3844
ThreadID: 832

#15 2026-09-29 20:34:14

DNS query (22 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

SOCPEDIA\localadmin

Query Name

sp.socpedia.net

Image: C:\Windows\System32\mstsc.exe
Process GUID: {93585ce4-da0b-6abb-4c33-000000001800}
Process ID: 7452
Query Name: sp.socpedia.net
Query Results: ::ffff:192.168.0.225;
Query Status: 0
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:34:12.004
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 8216

#16 2026-09-29 20:34:16

Group membership information (4627 "Security")

192.168.0.210

DC.socpedia.net

SP$

GroupMembership

%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name: SP$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x1240cbd1
GroupMembership: %{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 7144

#17 2026-09-29 20:34:16

An account was successfully logged on (4624 "Security")

192.168.0.210

DC.socpedia.net

SP$

Network Information: Source Network Address

192.168.0.225

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Information: Logon Type: 3
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name: SP$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x1240cbd1
Account Information: Logon GUID: {bd85057f-7674-3020-af7c-99dcbe5dcb2e}
Process Information: Process ID: 0x0
Process Information: Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.225
Network Information: Client Port: 65523
Detailed Authentication Information: Logon Process: Kerberos
Detailed Authentication Information: Authentication Package: Kerberos
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 7144

#18 2026-09-29 20:34:16

An account was logged off (4634 "Security")

192.168.0.210

DC.socpedia.net

SP$

Logon Type

3

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1134
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x1240cbd1
Logon Type: 3
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 720

#19 2026-09-29 20:34:16

An account was successfully logged on (4624 "Security")

192.168.0.210

DC.socpedia.net

SP$

Network Information: Source Network Address

192.168.0.225

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Information: Logon Type: 3
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name: SP$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x1240cbe9
Account Information: Logon GUID: {bd85057f-7674-3020-af7c-99dcbe5dcb2e}
Process Information: Process ID: 0x0
Process Information: Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.225
Network Information: Client Port: 65524
Detailed Authentication Information: Logon Process: Kerberos
Detailed Authentication Information: Authentication Package: Kerberos
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 3484

#20 2026-09-29 20:34:16

Group membership information (4627 "Security")

192.168.0.210

DC.socpedia.net

SP$

GroupMembership

%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name: SP$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x1240cbe9
GroupMembership: %{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 3484

#21 2026-09-29 20:34:16

An account was logged off (4634 "Security")

192.168.0.210

DC.socpedia.net

SP$

Logon Type

3

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1134
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x1240cbe9
Logon Type: 3
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 6304

#22 2026-09-29 20:34:16

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\System32\CredentialUIBroker.exe

Image: C:\Windows\System32\CredentialUIBroker.exe
Process GUID: {93585ce4-da74-6abb-4d33-000000001800}
Process ID: 2124
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:34:16.954
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 2392

#23 2026-09-29 20:34:16

Kerberos pre-authentication failed (4771 "Security")

192.168.0.210

DC.socpedia.net

localadmin

Network Information: Client Address

::ffff:192.168.0.231

Account Information: Account Name: localadmin
Account Information: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Service Information: Service Name: krbtgt/SOCPEDIA
Additional Information: Ticket Options: 0x40810010
Additional Information: Failure Code: 0x18
Additional Information: Pre-Authentication Type: 2
Network Information: Client Address: ::ffff:192.168.0.231
Network Information: Client Port: 49152
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 7144

#24 2026-09-29 20:34:17

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

TERMSRV/sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: TERMSRV/sp.socpedia.net
Type: 1
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3280

#25 2026-09-29 20:34:17

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

{28bfc32f-10f6-4738-98d1-1ac061df716a}:target=sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: {28bfc32f-10f6-4738-98d1-1ac061df716a}:target=sp.socpedia.net
Type: 6
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3280

#26 2026-09-29 20:34:17

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

TERMSRV/sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: TERMSRV/sp.socpedia.net
Type: 2
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3280

#27 2026-09-29 20:34:17

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: sp.socpedia.net
Type: 1
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3280

#28 2026-09-29 20:34:17

Credential Manager credentials were read (5379 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Target Name

sp.socpedia.net

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Target Name: sp.socpedia.net
Type: 2
Count Of Credentials Returned: 1
Subject: Read Operation: %%8099
Return Code: 3221226021
Process Creation Time: 2026-09-29T15:32:27.4902955Z
Client Process ID: 7452
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3280

#29 2026-09-29 20:34:17

A new process has been created (4688 "Security")

192.168.0.231

ws2025.socpedia.net

WS2025$

Process Information: Process Command Line

"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: WS2025$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0x11c8594a
Process Information: New Process ID: 0x1288
Process Information: Creator Process ID: 0x3e0
Process Information: New Process Name: C:\Windows\System32\CredentialUIBroker.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8202
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 4
ThreadID: 4740

#30 2026-09-29 20:34:17

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

SOCPEDIA\localadmin

Command Line

"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding

Command Line: "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding
Image: C:\Windows\System32\CredentialUIBroker.exe
Process GUID: {93585ce4-da79-6abb-4e33-000000001800}
Current Directory: C:\WINDOWS\system32\
Original File Name: CredentialUIBroker.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {93585ce4-288c-6aaa-0d00-000000001800}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=96BD4814912330AE2B72ABB7471759AA824C425B,SHA256=EA27C635CD810797D73F6F3AA57A166F77520DE7B46780E9D0FB749394FC9812,IMPHASH=CA5E4300F6ED0DA2C100D8C93121C4BC
Logon GUID: {93585ce4-c7b4-6abb-4a59-c81100000000}
Logon ID: 0x11c8594a
Integrity Level: Medium
Process ID: 4744
Parent Process ID: 992
Terminal Session ID: 7
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 2392

#31 2026-09-29 20:34:31

Special privileges assigned to new logon (4672 "Security")

192.168.0.210

DC.socpedia.net

DC$

Privileges

SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege SeEnableDelegationPrivilege

Subject: Security ID: S-1-5-18
Subject: Account Name: DC$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x1240ccbb
Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege SeEnableDelegationPrivilege
Computer: DC.socpedia.net
ProcessPID: 844
IP: 192.168.0.210
ThreadID: 3144

#32 2026-09-29 20:34:31

Group membership information (4627 "Security")

192.168.0.210

DC.socpedia.net

DC$

GroupMembership

%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-32-560} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-5-21-1838030176-2987033226-1986555923-1000} %{S-1-5-21-1838030176-2987033226-1986555923-516} %{S-1-5-9} %{S-1-18-1} %{S-1-5-21-1838030176-2987033226-1986555923-572} %{S-1-16-16384}

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
New Logon: Security ID: S-1-5-18
New Logon: Account Name: DC$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x1240ccbb
GroupMembership: %{S-1-5-32-544} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-32-560} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-5-21-1838030176-2987033226-1986555923-1000} %{S-1-5-21-1838030176-2987033226-1986555923-516} %{S-1-5-9} %{S-1-18-1} %{S-1-5-21-1838030176-2987033226-1986555923-572} %{S-1-16-16384}
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 3144

#33 2026-09-29 20:34:31

An account was successfully logged on (4624 "Security")

192.168.0.210

DC.socpedia.net

DC$

Network Information: Source Network Address

::1

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Information: Logon Type: 3
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-18
New Logon: Account Name: DC$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x1240ccbb
Account Information: Logon GUID: {9431cac8-0449-3814-2228-5cd91bb16aa1}
Process Information: Process ID: 0x0
Process Information: Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: ::1
Network Information: Client Port: 59753
Detailed Authentication Information: Logon Process: Kerberos
Detailed Authentication Information: Authentication Package: Kerberos
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 3144

#34 2026-09-29 20:34:31

An account was logged off (4634 "Security")

192.168.0.210

DC.socpedia.net

DC$

Logon Type

3

Subject: Security ID: S-1-5-18
Subject: Account Name: DC$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x1240ccbb
Logon Type: 3
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 6304

#35 2026-09-29 20:34:32

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\System32\CredentialUIBroker.exe

Image: C:\Windows\System32\CredentialUIBroker.exe
Process GUID: {93585ce4-da79-6abb-4e33-000000001800}
Process ID: 4744
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:34:32.059
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 2392

#36 2026-09-29 20:34:32

Listener RDP-Tcp received a connection (261 "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational")

192.168.0.225

SP.socpedia.net

Listener Name

RDP-Tcp

Listener Name: RDP-Tcp
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 1076
ThreadID: 1988

#37 2026-09-29 20:34:32

A Kerberos authentication ticket (TGT) was requested (4768 "Security")

192.168.0.210

DC.socpedia.net

localadmin

Network Information: Source Network Address

::ffff:192.168.0.231

Account Information: Account Name: localadmin
Account Information: Account Domain: SOCPEDIA
Account Information: User ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Service Information: Service Name: krbtgt
Service Information: Service ID: S-1-5-21-1838030176-2987033226-1986555923-502
Additional Information: Ticket Options: 0x40810010
Additional Information: Failure Code: 0x0
Additional Information: Ticket Encryption Type: 0x12
Additional Information: Pre-Authentication Type: 2
Network Information: Source Network Address: ::ffff:192.168.0.231
Network Information: Client Port: 49156
Ticket information: Response ticket hash: jKQ+QXS/mj+cMXpPOGp7tX8MvS+6tJiu6n8OHUOlmmc=
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 3484

#38 2026-09-29 20:34:32

A Kerberos service ticket was requested (4769 "Security")

192.168.0.210

DC.socpedia.net

localadmin@SOCPEDIA.NET

Network Information: Client Address

::ffff:192.168.0.231

Account Information: Account Name: localadmin@SOCPEDIA.NET
Account Information: Account Domain: SOCPEDIA.NET
Account Information: Logon GUID: {fd798913-ad89-5a55-5278-48d64bfaeb36}
Service Information: Service Name: SP$
Service Information: Service ID: S-1-5-21-1838030176-2987033226-1986555923-1134
Network Information: Client Address: ::ffff:192.168.0.231
Network Information: Source Port: 49157
Additional Information: Ticket Options: 0x40810000
Additional Information: Ticket Encryption Type: 0x12
Additional Information: Failure Code: 0x0
Additional Information: Transited Services: -
Ticket information: Request ticket hash: jKQ+QXS/mj+cMXpPOGp7tX8MvS+6tJiu6n8OHUOlmmc=
Ticket information: Response ticket hash: ducU+NCNxx7W8r5O1HeO/R7jFBYBuRwUPqBjmd9Fur8=
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 3144

#39 2026-09-29 20:34:32

A logon was attempted using explicit credentials (4648 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Network Information: Network Address

-

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Subject: Logon GUID: {e08c8bfd-cb0f-213d-4961-48e33e33225f}
Account Whose Credentials Were Used: Account Name: localadmin
Account Whose Credentials Were Used: Account Domain: SOCPEDIA.NET
Account Whose Credentials Were Used: Logon GUID: {fd798913-ad89-5a55-5278-48d64bfaeb36}
Target Server: Target Server Name: sp.socpedia.net
Target Server: Additional Information: TERMSRV/sp.socpedia.net
Process Information: Process ID: 0x35c
Process Information: Process Name: C:\Windows\System32\lsass.exe
Network Information: Network Address: -
Network Information: Port: -
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#40 2026-09-29 20:34:32

A Kerberos service ticket was requested (4769 "Security")

192.168.0.210

DC.socpedia.net

localadmin@SOCPEDIA.NET

Network Information: Client Address

::ffff:192.168.0.231

Account Information: Account Name: localadmin@SOCPEDIA.NET
Account Information: Account Domain: SOCPEDIA.NET
Account Information: Logon GUID: {fd798913-ad89-5a55-5278-48d64bfaeb36}
Service Information: Service Name: SP$
Service Information: Service ID: S-1-5-21-1838030176-2987033226-1986555923-1134
Network Information: Client Address: ::ffff:192.168.0.231
Network Information: Source Port: 49158
Additional Information: Ticket Options: 0x40810008
Additional Information: Ticket Encryption Type: 0x12
Additional Information: Failure Code: 0x0
Additional Information: Transited Services: -
Ticket information: Request ticket hash: jKQ+QXS/mj+cMXpPOGp7tX8MvS+6tJiu6n8OHUOlmmc=
Ticket information: Response ticket hash: sAYWYH1xoCGS1uNnajEYluSqsMQq/jByRT2O1EoWylI=
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 3144

#41 2026-09-29 20:34:32

A logon was attempted using explicit credentials (4648 "Security")

192.168.0.231

ws2025.socpedia.net

localadmin

Network Information: Network Address

-

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x11c8594a
Subject: Logon GUID: {e08c8bfd-cb0f-213d-4961-48e33e33225f}
Account Whose Credentials Were Used: Account Name: localadmin
Account Whose Credentials Were Used: Account Domain: SOCPEDIA.NET
Account Whose Credentials Were Used: Logon GUID: {fd798913-ad89-5a55-5278-48d64bfaeb36}
Target Server: Target Server Name: sp.socpedia.net
Target Server: Additional Information: TERMSRV/sp.socpedia.net
Process Information: Process ID: 0x35c
Process Information: Process Name: C:\Windows\System32\lsass.exe
Network Information: Network Address: -
Network Information: Port: -
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 860
ThreadID: 3952

#42 2026-09-29 20:34:32

Group membership information (4627 "Security")

192.168.0.225

SP.socpedia.net

localadmin

GroupMembership

%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-555} %{S-1-5-32-545} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8192}

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name: localadmin
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0xa1a3420
GroupMembership: %{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-555} %{S-1-5-32-545} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8192}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 6308

#43 2026-09-29 20:34:32

An account was successfully logged on (4624 "Security")

192.168.0.225

SP.socpedia.net

localadmin

Network Information: Source Network Address

192.168.0.231

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Information: Logon Type: 3
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name: localadmin
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0xa1a3420
Account Information: Logon GUID: {fd798913-ad89-5a55-5278-48d64bfaeb36}
Process Information: Process ID: 0x0
Process Information: Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.231
Network Information: Client Port: 0
Detailed Authentication Information: Logon Process: Kerberos
Detailed Authentication Information: Authentication Package: Kerberos
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 6308

#44 2026-09-29 20:34:32

Remote Desktop Services: User authentication succeeded (1149 "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational")

192.168.0.225

SP.socpedia.net

localadmin

Source Network Address

192.168.0.231

User: localadmin
Domain: SOCPEDIA
Source Network Address: 192.168.0.231
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 1076
ThreadID: 4732

#45 2026-09-29 20:34:32

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

\SystemRoot\System32\smss.exe 0000012c 00000118

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: -
Target Subject: Account Domain: -
Target Subject: Logon ID: 0x0
Process Information: New Process ID: 0xe6c
Process Information: Creator Process ID: 0x1d0
Process Information: New Process Name: C:\Windows\System32\smss.exe
Process Information: Creator Process Name: C:\Windows\System32\smss.exe
Process Information: Process Command Line: \SystemRoot\System32\smss.exe 0000012c 00000118
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-16384
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 4828

#46 2026-09-29 20:34:32

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Command Line

\SystemRoot\System32\smss.exe 0000012c 00000118

Command Line: \SystemRoot\System32\smss.exe 0000012c 00000118
Image: C:\Windows\System32\smss.exe
Process GUID: {88ea2655-da88-6abb-b11d-000000000700}
Current Directory: C:\WINDOWS\
Original File Name: smss.exe
User: NT AUTHORITY\SYSTEM
Parent Command Line: \SystemRoot\System32\smss.exe
Parent Image: C:\Windows\System32\smss.exe
Parent Process GUID: {88ea2655-9c98-6ab2-0300-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=0964C0290FFAB099ADC667475180BE93EDDADB68,SHA256=F2F0E04E01C361434A0453F2A49F819DC11E8F7420623432E3C15D5BB12B0785,IMPHASH=28CC89F7288C7AA854AB6380B2A6B3E2
Logon GUID: {88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID: 0x3e7
Integrity Level: System
Process ID: 3692
Parent Process ID: 464
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#47 2026-09-29 20:34:32

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: -
Target Subject: Account Domain: -
Target Subject: Logon ID: 0x0
Process Information: New Process ID: 0x1454
Process Information: Creator Process ID: 0xe6c
Process Information: New Process Name: C:\Windows\System32\csrss.exe
Process Information: Creator Process Name: C:\Windows\System32\smss.exe
Process Information: Process Command Line: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-16384
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 4828

#48 2026-09-29 20:34:32

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Command Line

%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

Command Line: %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
Image: C:\Windows\System32\csrss.exe
Process GUID: {88ea2655-da88-6abb-b21d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: CSRSS.Exe
User: NT AUTHORITY\SYSTEM
Parent Command Line: \SystemRoot\System32\smss.exe 0000012c 00000118
Parent Image: C:\Windows\System32\smss.exe
Parent Process GUID: {88ea2655-da88-6abb-b11d-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=17397F105F7D51112261ECC501FE99B8FCF4DE67,SHA256=A958083FD4982697973D1F4A05A8F51B1F5D551A558CFA0097CFB6867FDCE3BA,IMPHASH=2A4F07729AD0B91A59C641DBB9BBB3E7
Logon GUID: {88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID: 0x3e7
Integrity Level: System
Process ID: 5204
Parent Process ID: 3692
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#49 2026-09-29 20:34:32

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

winlogon.exe

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: -
Target Subject: Account Domain: -
Target Subject: Logon ID: 0x0
Process Information: New Process ID: 0x1714
Process Information: Creator Process ID: 0xe6c
Process Information: New Process Name: C:\Windows\System32\winlogon.exe
Process Information: Creator Process Name: C:\Windows\System32\smss.exe
Process Information: Process Command Line: winlogon.exe
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-16384
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7160

#50 2026-09-29 20:34:32

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Command Line

winlogon.exe

Command Line: winlogon.exe
Image: C:\Windows\System32\winlogon.exe
Process GUID: {88ea2655-da88-6abb-b31d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: WINLOGON.EXE
User: NT AUTHORITY\SYSTEM
Parent Command Line: \SystemRoot\System32\smss.exe 0000012c 00000118
Parent Image: C:\Windows\System32\smss.exe
Parent Process GUID: {88ea2655-da88-6abb-b11d-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=F3C85BF59E27D9B6FEB6C9720E8DF4579DF2F3AD,SHA256=F3ABBAA66E1EDA9D39036C146F69592B43F5A0E76B7C3862306CE1E1B66FAC87,IMPHASH=53C334FC36A981610E3B67893127555B
Logon GUID: {88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID: 0x3e7
Integrity Level: System
Process ID: 5908
Parent Process ID: 3692
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#51 2026-09-29 20:34:32

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Image

C:\Windows\System32\smss.exe

Image: C:\Windows\System32\smss.exe
Process GUID: {88ea2655-da88-6abb-b11d-000000000700}
Process ID: 3692
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:32.360
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#52 2026-09-29 20:34:32

Group membership information (4627 "Security")

192.168.0.225

SP.socpedia.net

SYSTEM

GroupMembership

%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Type: 5
New Logon: Security ID: S-1-5-18
New Logon: Account Name: SYSTEM
New Logon: Account Domain: NT AUTHORITY
New Logon: Logon ID: 0x3e7
GroupMembership: %{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 6308

#53 2026-09-29 20:34:32

An account was successfully logged on (4624 "Security")

192.168.0.225

SP.socpedia.net

SYSTEM

Network Information: Source Network Address

-

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Information: Logon Type: 5
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-18
New Logon: Account Name: SYSTEM
New Logon: Account Domain: NT AUTHORITY
New Logon: Logon ID: 0x3e7
Account Information: Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information: Process ID: 0x364
Process Information: Process Name: C:\Windows\System32\services.exe
Network Information: Workstation Name: -
Network Information: Source Network Address: -
Network Information: Client Port: -
Detailed Authentication Information: Logon Process: Advapi
Detailed Authentication Information: Authentication Package: Negotiate
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 6308

#54 2026-09-29 20:34:32

Special privileges assigned to new logon (4672 "Security")

192.168.0.225

SP.socpedia.net

SYSTEM

Privileges

SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege

Subject: Security ID: S-1-5-18
Subject: Account Name: SYSTEM
Subject: Account Domain: NT AUTHORITY
Subject: Logon ID: 0x3e7
Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Computer: SP.socpedia.net
ProcessPID: 876
IP: 192.168.0.225
ThreadID: 6308

#55 2026-09-29 20:34:32

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s DsmSvc

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: -
Target Subject: Account Domain: -
Target Subject: Logon ID: 0x0
Process Information: New Process ID: 0x206c
Process Information: Creator Process ID: 0x364
Process Information: New Process Name: C:\Windows\System32\svchost.exe
Process Information: Creator Process Name: C:\Windows\System32\services.exe
Process Information: Process Command Line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s DsmSvc
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-16384
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 4828

#56 2026-09-29 20:34:32

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Command Line

C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s DsmSvc

Command Line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s DsmSvc
Image: C:\Windows\System32\svchost.exe
Process GUID: {88ea2655-da88-6abb-b41d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: svchost.exe
User: NT AUTHORITY\SYSTEM
Parent Command Line: C:\WINDOWS\system32\services.exe
Parent Image: C:\Windows\System32\services.exe
Parent Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID: {88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID: 0x3e7
Integrity Level: System
Process ID: 8300
Parent Process ID: 868
Terminal Session ID: 0
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#57 2026-09-29 20:34:32

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\WINDOWS\system32\DllHost.exe /Processid:{6C752774-29FB-4E50-8BB1-97098425A77C}

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: -
Target Subject: Account Domain: -
Target Subject: Logon ID: 0x0
Process Information: New Process ID: 0x77c
Process Information: Creator Process ID: 0x3e8
Process Information: New Process Name: C:\Windows\System32\dllhost.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: C:\WINDOWS\system32\DllHost.exe /Processid:{6C752774-29FB-4E50-8BB1-97098425A77C}
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-16384
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 6468

#58 2026-09-29 20:34:32

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Command Line

C:\WINDOWS\system32\DllHost.exe /Processid:{6C752774-29FB-4E50-8BB1-97098425A77C}

Command Line: C:\WINDOWS\system32\DllHost.exe /Processid:{6C752774-29FB-4E50-8BB1-97098425A77C}
Image: C:\Windows\System32\dllhost.exe
Process GUID: {88ea2655-da88-6abb-b51d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: dllhost.exe
User: NT AUTHORITY\SYSTEM
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=F401AE9310FAB4781A3E9FA1EAFF26F3D484C6E0,SHA256=50C9C2EDEA6C51F1AAD2DD80A59F4EDB32637F51714F8472D216E5B9BDACDABF,IMPHASH=FBDAC0471446783AD621D3CAB6033559
Logon GUID: {88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID: 0x3e7
Integrity Level: System
Process ID: 1916
Parent Process ID: 1000
Terminal Session ID: 0
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#59 2026-09-29 20:34:32

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}\0007\DriverVersion

Details: 10.0.26100.1150
Event Type: SetValue
Image: System
Process GUID: {88ea2655-9c98-6ab2-eb03-000000000000}
Process ID: 4
Target Object: HKLM\System\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}\0007\DriverVersion
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:32.594
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#60 2026-09-29 20:34:32

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318}\0008\DriverVersion

Details: 10.0.26100.1
Event Type: SetValue
Image: System
Process GUID: {88ea2655-9c98-6ab2-eb03-000000000000}
Process ID: 4
Target Object: HKLM\System\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318}\0008\DriverVersion
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:32.611
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#61 2026-09-29 20:34:32

A privileged service was called (4673 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process: Process Name

C:\Windows\System32\lsass.exe

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Service: Server: NT Local Security Authority / Authentication Service
Service: Service Name: LsaRegisterLogonProcess()
Service Request Information: Privileges: SeTcbPrivilege
Process: Process ID: 0x36c
Process: Process Name: C:\Windows\System32\lsass.exe
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7640

#62 2026-09-29 20:34:32

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d6c6074f-3006-4c43-a16f-b2ed9b142b2e -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a07959f0-1dca-44d0-be4b-a19378d712c4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c1449372-7d71-4f75-ad2c-6dd5fc866372 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5b070224-875c-420c-9f73-3e6f5e93fd9f -LifetimeId:a608cb82-0010-4a86-a23c-79cfddc707ff -DeviceGroupId: -HostArg:16

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-5-19
Target Subject: Account Name: LOCAL SERVICE
Target Subject: Account Domain: NT AUTHORITY
Target Subject: Logon ID: 0x3e5
Process Information: New Process ID: 0xfd0
Process Information: Creator Process ID: 0x364
Process Information: New Process Name: C:\Windows\System32\WUDFHost.exe
Process Information: Creator Process Name: C:\Windows\System32\services.exe
Process Information: Process Command Line: "C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d6c6074f-3006-4c43-a16f-b2ed9b142b2e -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a07959f0-1dca-44d0-be4b-a19378d712c4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c1449372-7d71-4f75-ad2c-6dd5fc866372 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5b070224-875c-420c-9f73-3e6f5e93fd9f -LifetimeId:a608cb82-0010-4a86-a23c-79cfddc707ff -DeviceGroupId: -HostArg:16
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-16384
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7160

#63 2026-09-29 20:34:32

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0007\DriverVersion

Details: 10.0.26100.1150
Event Type: SetValue
Image: System
Process GUID: {88ea2655-9c98-6ab2-eb03-000000000000}
Process ID: 4
Target Object: HKLM\System\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0007\DriverVersion
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:32.923
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#64 2026-09-29 20:34:33

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\LOCAL SERVICE

Command Line

"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d6c6074f-3006-4c43-a16f-b2ed9b142b2e -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a07959f0-1dca-44d0-be4b-a19378d712c4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c1449372-7d71-4f75-ad2c-6dd5fc866372 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5b070224-875c-420c-9f73-3e6f5e93fd9f -LifetimeId:a608cb82-0010-4a86-a23c-79cfddc707ff -DeviceGroupId: -HostArg:16

Command Line: "C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d6c6074f-3006-4c43-a16f-b2ed9b142b2e -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a07959f0-1dca-44d0-be4b-a19378d712c4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c1449372-7d71-4f75-ad2c-6dd5fc866372 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5b070224-875c-420c-9f73-3e6f5e93fd9f -LifetimeId:a608cb82-0010-4a86-a23c-79cfddc707ff -DeviceGroupId: -HostArg:16
Image: C:\Windows\System32\WUDFHost.exe
Process GUID: {88ea2655-da88-6abb-b61d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: WUDFHost.exe
User: NT AUTHORITY\LOCAL SERVICE
Parent Command Line: C:\WINDOWS\system32\services.exe
Parent Image: C:\Windows\System32\services.exe
Parent Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=18B8DD627AADF8BEB284555C567CAAFC9967848B,SHA256=83AD7A97BCA7CA166E39321299E1CA5C429FAE8A2FFB0E18317BFDBC57674D3A,IMPHASH=40D6714D557D33E27D0D7BA48E7C8ED4
Logon GUID: {88ea2655-9caa-6ab2-e503-000000000000}
Logon ID: 0x3e5
Integrity Level: System
Process ID: 4048
Parent Process ID: 868
Terminal Session ID: 0
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#65 2026-09-29 20:34:33

A privileged service was called (4673 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process: Process Name

C:\Windows\System32\lsass.exe

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Service: Server: NT Local Security Authority / Authentication Service
Service: Service Name: LsaRegisterLogonProcess()
Service Request Information: Privileges: SeTcbPrivilege
Process: Process ID: 0x36c
Process: Process Name: C:\Windows\System32\lsass.exe
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7160

#66 2026-09-29 20:34:33

Process Access (10 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Image

C:\WINDOWS\system32\winlogon.exe

RuleName: v1-0_io_T_Winlogon
UTC Time: 2026-09-29 15:34:33.026
Source Process GUID: {88ea2655-9ca8-6ab2-0c00-000000000700}
Source Process ID: 876
Source Thread ID: 7792
Source Image: C:\WINDOWS\system32\lsass.exe
Target Process GUID: {88ea2655-da88-6abb-b31d-000000000700}
Target Process ID: 5908
Target Image: C:\WINDOWS\system32\winlogon.exe
Granted Access: 0x1478
Call Trace: C:\WINDOWS\SYSTEM32\ntdll.dll+15f2c4|C:\WINDOWS\system32\lsasrv.dll+24e84|C:\WINDOWS\system32\lsasrv.dll+2487a|C:\WINDOWS\system32\lsasrv.dll+24473|C:\WINDOWS\SYSTEM32\SspiSrv.dll+1b9d|C:\WINDOWS\System32\RPCRT4.dll+d1913|C:\WINDOWS\System32\RPCRT4.dll+d618e|C:\WINDOWS\System32\RPCRT4.dll+85cdc|C:\WINDOWS\System32\RPCRT4.dll+83897|C:\WINDOWS\System32\RPCRT4.dll+360f4|C:\WINDOWS\System32\RPCRT4.dll+37108|C:\WINDOWS\System32\RPCRT4.dll+300b4|C:\WINDOWS\System32\RPCRT4.dll+3463a|C:\WINDOWS\System32\RPCRT4.dll+3a65c|C:\WINDOWS\System32\RPCRT4.dll+397e3|C:\WINDOWS\System32\RPCRT4.dll+38788|C:\WINDOWS\SYSTEM32\ntdll.dll+51683|C:\WINDOWS\SYSTEM32\ntdll.dll+51fa3|C:\WINDOWS\System32\KERNEL32.DLL+2dbe7|C:\WINDOWS\SYSTEM32\ntdll.dll+85a6c
Source User: NT AUTHORITY\SYSTEM
Target User: NT AUTHORITY\SYSTEM
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#67 2026-09-29 20:34:33

An account was successfully logged on (4624 "Security")

192.168.0.225

SP.socpedia.net

UMFD-7

Network Information: Source Network Address

-

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Information: Logon Type: 2
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-96-0-7
New Logon: Account Name: UMFD-7
New Logon: Account Domain: Font Driver Host
New Logon: Logon ID: 0xa1a8cbd
Account Information: Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information: Process ID: 0x1714
Process Information: Process Name: C:\Windows\System32\winlogon.exe
Network Information: Workstation Name: -
Network Information: Source Network Address: -
Network Information: Client Port: -
Detailed Authentication Information: Logon Process: Advapi
Detailed Authentication Information: Authentication Package: Negotiate
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#68 2026-09-29 20:34:33

Group membership information (4627 "Security")

192.168.0.225

SP.socpedia.net

UMFD-7

GroupMembership

%{S-1-16-8192} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-4} %{S-1-5-11} %{S-1-5-15} %{S-1-5-96-0}

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Type: 2
New Logon: Security ID: S-1-5-96-0-7
New Logon: Account Name: UMFD-7
New Logon: Account Domain: Font Driver Host
New Logon: Logon ID: 0xa1a8cbd
GroupMembership: %{S-1-16-8192} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-4} %{S-1-5-11} %{S-1-5-15} %{S-1-5-96-0}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#69 2026-09-29 20:34:33

A logon was attempted using explicit credentials (4648 "Security")

192.168.0.225

SP.socpedia.net

UMFD-7

Network Information: Network Address

-

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Subject: Logon GUID: {00000000-0000-0000-0000-000000000000}
Account Whose Credentials Were Used: Account Name: UMFD-7
Account Whose Credentials Were Used: Account Domain: Font Driver Host
Account Whose Credentials Were Used: Logon GUID: {00000000-0000-0000-0000-000000000000}
Target Server: Target Server Name: localhost
Target Server: Additional Information: localhost
Process Information: Process ID: 0x1714
Process Information: Process Name: C:\Windows\System32\winlogon.exe
Network Information: Network Address: -
Network Information: Port: -
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#70 2026-09-29 20:34:33

A change has been made to Windows Firewall exception list. A rule was deleted (4948 "Security")

192.168.0.225

SP.socpedia.net

Deleted Rule: Rule Name

Usermode Font Driver Host

Profile Changed: All
Deleted Rule: Rule ID: microsoft.windows.fontdrvhost-Out-Block
Deleted Rule: Rule Name: Usermode Font Driver Host
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#71 2026-09-29 20:34:33

A change has been made to Windows Firewall exception list. A rule was deleted (4948 "Security")

192.168.0.225

SP.socpedia.net

Deleted Rule: Rule Name

Usermode Font Driver Host

Profile Changed: All
Deleted Rule: Rule ID: microsoft.windows.fontdrvhost-In-Block
Deleted Rule: Rule Name: Usermode Font Driver Host
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#72 2026-09-29 20:34:33

A change has been made to Windows Firewall exception list. A rule was added (4946 "Security")

192.168.0.225

SP.socpedia.net

Added Rule: Rule Name

Usermode Font Driver Host

Profile Changed: All
Added Rule: Rule ID: microsoft.windows.fontdrvhost-In-Block
Added Rule: Rule Name: Usermode Font Driver Host
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#73 2026-09-29 20:34:33

A change has been made to Windows Firewall exception list. A rule was added (4946 "Security")

192.168.0.225

SP.socpedia.net

Added Rule: Rule Name

Usermode Font Driver Host

Profile Changed: All
Added Rule: Rule ID: microsoft.windows.fontdrvhost-Out-Block
Added Rule: Rule Name: Usermode Font Driver Host
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#74 2026-09-29 20:34:33

Process Access (10 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Image

C:\WINDOWS\system32\winlogon.exe

RuleName: v1-0_io_T_Winlogon
UTC Time: 2026-09-29 15:34:33.107
Source Process GUID: {88ea2655-9ca8-6ab2-0c00-000000000700}
Source Process ID: 876
Source Thread ID: 7792
Source Image: C:\WINDOWS\system32\lsass.exe
Target Process GUID: {88ea2655-da88-6abb-b31d-000000000700}
Target Process ID: 5908
Target Image: C:\WINDOWS\system32\winlogon.exe
Granted Access: 0x1478
Call Trace: C:\WINDOWS\SYSTEM32\ntdll.dll+15f2c4|C:\WINDOWS\system32\lsasrv.dll+24e84|C:\WINDOWS\system32\lsasrv.dll+2487a|C:\WINDOWS\system32\lsasrv.dll+24473|C:\WINDOWS\SYSTEM32\SspiSrv.dll+1b9d|C:\WINDOWS\System32\RPCRT4.dll+d1913|C:\WINDOWS\System32\RPCRT4.dll+d618e|C:\WINDOWS\System32\RPCRT4.dll+85cdc|C:\WINDOWS\System32\RPCRT4.dll+83897|C:\WINDOWS\System32\RPCRT4.dll+360f4|C:\WINDOWS\System32\RPCRT4.dll+37108|C:\WINDOWS\System32\RPCRT4.dll+300b4|C:\WINDOWS\System32\RPCRT4.dll+3463a|C:\WINDOWS\System32\RPCRT4.dll+3a65c|C:\WINDOWS\System32\RPCRT4.dll+397e3|C:\WINDOWS\System32\RPCRT4.dll+38788|C:\WINDOWS\SYSTEM32\ntdll.dll+51683|C:\WINDOWS\SYSTEM32\ntdll.dll+51fa3|C:\WINDOWS\System32\KERNEL32.DLL+2dbe7|C:\WINDOWS\SYSTEM32\ntdll.dll+85a6c
Source User: NT AUTHORITY\SYSTEM
Target User: NT AUTHORITY\SYSTEM
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#75 2026-09-29 20:34:33

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

"fontdrvhost.exe"

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: UMFD-7
Target Subject: Account Domain: Font Driver Host
Target Subject: Logon ID: 0xa1a8cbd
Process Information: New Process ID: 0x141c
Process Information: Creator Process ID: 0x1714
Process Information: New Process Name: C:\Windows\System32\fontdrvhost.exe
Process Information: Creator Process Name: C:\Windows\System32\winlogon.exe
Process Information: Process Command Line: "fontdrvhost.exe"
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-4096
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 5052

#76 2026-09-29 20:34:33

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

Font Driver Host\UMFD-7

Command Line

"fontdrvhost.exe"

Command Line: "fontdrvhost.exe"
Image: C:\Windows\System32\fontdrvhost.exe
Process GUID: {88ea2655-da89-6abb-b71d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: fontdrvhost.exe
User: Font Driver Host\UMFD-7
Parent Command Line: winlogon.exe
Parent Image: C:\Windows\System32\winlogon.exe
Parent Process GUID: {88ea2655-da88-6abb-b31d-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=0C91727E9D382AF6A4DA291033E28A7195DA5B38,SHA256=0D0B03B6290876B819F2ADF72AC62ADC86224588CAAD3C0176DB5F6A63F6F8F5,IMPHASH=79DC40755BB236C673EF87052EA440ED
Logon GUID: {88ea2655-da89-6abb-bd8c-1a0a00000000}
Logon ID: 0xa1a8cbd
Integrity Level: AppContainer
Process ID: 5148
Parent Process ID: 5908
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#77 2026-09-29 20:34:33

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

"LogonUI.exe" /flags:0x2 /state0:0xa7ca3055 /state1:0x41c64e6d

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: -
Target Subject: Account Domain: -
Target Subject: Logon ID: 0x0
Process Information: New Process ID: 0xb48
Process Information: Creator Process ID: 0x1714
Process Information: New Process Name: C:\Windows\System32\LogonUI.exe
Process Information: Creator Process Name: C:\Windows\System32\winlogon.exe
Process Information: Process Command Line: "LogonUI.exe" /flags:0x2 /state0:0xa7ca3055 /state1:0x41c64e6d
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-16384
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7160

#78 2026-09-29 20:34:33

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Command Line

"LogonUI.exe" /flags:0x2 /state0:0xa7ca3055 /state1:0x41c64e6d

Command Line: "LogonUI.exe" /flags:0x2 /state0:0xa7ca3055 /state1:0x41c64e6d
Image: C:\Windows\System32\LogonUI.exe
Process GUID: {88ea2655-da89-6abb-b81d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: logonui.exe
User: NT AUTHORITY\SYSTEM
Parent Command Line: winlogon.exe
Parent Image: C:\Windows\System32\winlogon.exe
Parent Process GUID: {88ea2655-da88-6abb-b31d-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=4E12304C2F97D9EEB879DEC3538B9233595BDD96,SHA256=60F7DD6D487F76FE546E3E303A31791150C6E77C89857EC10FBA1D9BFE7F0174,IMPHASH=12C5798A52775C4FC87AB3651B893662
Logon GUID: {88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID: 0x3e7
Integrity Level: System
Process ID: 2888
Parent Process ID: 5908
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#79 2026-09-29 20:34:33

CreateRemoteThread detected (8 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Image

C:\Windows\System32\csrss.exe

New Thread ID: 7572
Source Image: C:\Windows\System32\winlogon.exe
Source Process GUID: {88ea2655-da88-6abb-b31d-000000000700}
Source Process ID: 5908
Source User: NT AUTHORITY\SYSTEM
Start Address: 0xFFFFF806655BD5A0
Start Function: -
Start Module: -
Target Image: C:\Windows\System32\csrss.exe
Target Process GUID: {88ea2655-da88-6abb-b21d-000000000700}
Target Process ID: 5204
Target User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:33.188
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#80 2026-09-29 20:34:33

A logon was attempted using explicit credentials (4648 "Security")

192.168.0.225

SP.socpedia.net

DWM-7

Network Information: Network Address

-

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Subject: Logon GUID: {00000000-0000-0000-0000-000000000000}
Account Whose Credentials Were Used: Account Name: DWM-7
Account Whose Credentials Were Used: Account Domain: Window Manager
Account Whose Credentials Were Used: Logon GUID: {00000000-0000-0000-0000-000000000000}
Target Server: Target Server Name: localhost
Target Server: Additional Information: localhost
Process Information: Process ID: 0x1714
Process Information: Process Name: C:\Windows\System32\winlogon.exe
Network Information: Network Address: -
Network Information: Port: -
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#81 2026-09-29 20:34:33

Group membership information (4627 "Security")

192.168.0.225

SP.socpedia.net

DWM-7

GroupMembership

%{S-1-16-8192} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-4} %{S-1-5-11} %{S-1-5-15} %{S-1-5-19} %{S-1-2-0} %{S-1-5-90-0}

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Type: 2
New Logon: Security ID: S-1-5-90-0-7
New Logon: Account Name: DWM-7
New Logon: Account Domain: Window Manager
New Logon: Logon ID: 0xa1aa2d2
GroupMembership: %{S-1-16-8192} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-4} %{S-1-5-11} %{S-1-5-15} %{S-1-5-19} %{S-1-2-0} %{S-1-5-90-0}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#82 2026-09-29 20:34:33

An account was successfully logged on (4624 "Security")

192.168.0.225

SP.socpedia.net

DWM-7

Network Information: Source Network Address

-

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Information: Logon Type: 2
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-90-0-7
New Logon: Account Name: DWM-7
New Logon: Account Domain: Window Manager
New Logon: Logon ID: 0xa1aa29d
Account Information: Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information: Process ID: 0x1714
Process Information: Process Name: C:\Windows\System32\winlogon.exe
Network Information: Workstation Name: -
Network Information: Source Network Address: -
Network Information: Client Port: -
Detailed Authentication Information: Logon Process: Advapi
Detailed Authentication Information: Authentication Package: Negotiate
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#83 2026-09-29 20:34:33

Special privileges assigned to new logon (4672 "Security")

192.168.0.225

SP.socpedia.net

DWM-7

Privileges

SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege

Subject: Security ID: S-1-5-90-0-7
Subject: Account Name: DWM-7
Subject: Account Domain: Window Manager
Subject: Logon ID: 0xa1aa29d
Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
Computer: SP.socpedia.net
ProcessPID: 876
IP: 192.168.0.225
ThreadID: 7792

#84 2026-09-29 20:34:33

An account was successfully logged on (4624 "Security")

192.168.0.225

SP.socpedia.net

DWM-7

Network Information: Source Network Address

-

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Information: Logon Type: 2
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-90-0-7
New Logon: Account Name: DWM-7
New Logon: Account Domain: Window Manager
New Logon: Logon ID: 0xa1aa2d2
Account Information: Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information: Process ID: 0x1714
Process Information: Process Name: C:\Windows\System32\winlogon.exe
Network Information: Workstation Name: -
Network Information: Source Network Address: -
Network Information: Client Port: -
Detailed Authentication Information: Logon Process: Advapi
Detailed Authentication Information: Authentication Package: Negotiate
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#85 2026-09-29 20:34:33

Group membership information (4627 "Security")

192.168.0.225

SP.socpedia.net

DWM-7

GroupMembership

%{S-1-16-16384} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-4} %{S-1-5-11} %{S-1-5-15} %{S-1-5-19} %{S-1-2-0} %{S-1-5-90-0}

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Type: 2
New Logon: Security ID: S-1-5-90-0-7
New Logon: Account Name: DWM-7
New Logon: Account Domain: Window Manager
New Logon: Logon ID: 0xa1aa29d
GroupMembership: %{S-1-16-16384} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-4} %{S-1-5-11} %{S-1-5-15} %{S-1-5-19} %{S-1-2-0} %{S-1-5-90-0}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#86 2026-09-29 20:34:33

Special privileges assigned to new logon (4672 "Security")

192.168.0.225

SP.socpedia.net

DWM-7

Privileges

SeAssignPrimaryTokenPrivilege SeAuditPrivilege

Subject: Security ID: S-1-5-90-0-7
Subject: Account Name: DWM-7
Subject: Account Domain: Window Manager
Subject: Logon ID: 0xa1aa2d2
Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
Computer: SP.socpedia.net
ProcessPID: 876
IP: 192.168.0.225
ThreadID: 7792

#87 2026-09-29 20:34:33

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

"dwm.exe"

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-5-90-0-7
Target Subject: Account Name: DWM-7
Target Subject: Account Domain: Window Manager
Target Subject: Logon ID: 0xa1aa2d2
Process Information: New Process ID: 0x167c
Process Information: Creator Process ID: 0x1714
Process Information: New Process Name: C:\Windows\System32\dwm.exe
Process Information: Creator Process Name: C:\Windows\System32\winlogon.exe
Process Information: Process Command Line: "dwm.exe"
Process Information: Token Elevation Type: %%1938
Process Information: Mandatory Label: S-1-16-16384
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7160

#88 2026-09-29 20:34:33

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

Window Manager\DWM-7

Command Line

"dwm.exe"

Command Line: "dwm.exe"
Image: C:\Windows\System32\dwm.exe
Process GUID: {88ea2655-da89-6abb-b91d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: dwm.exe
User: Window Manager\DWM-7
Parent Command Line: winlogon.exe
Parent Image: C:\Windows\System32\winlogon.exe
Parent Process GUID: {88ea2655-da88-6abb-b31d-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=278B4D35AB2675A8048754C604B257F7566E89FA,SHA256=A5B1818D8AF48A5B0C068E82229708C869EC4C840150F7AEF5D971FC60EA4F55,IMPHASH=094F727BC8D4986CF359917BD9BBCB36
Logon GUID: {88ea2655-da89-6abb-d2a2-1a0a00000000}
Logon ID: 0xa1aa2d2
Integrity Level: System
Process ID: 5756
Parent Process ID: 5908
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#89 2026-09-29 20:34:33

A new external device was recognized by the system (6416 "Security")

192.168.0.225

SP.socpedia.net

SP$

Device Name

Microsoft Remote Display Adapter

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Device ID: SWD\RemoteDisplayEnum\RdpIdd_IndirectDisplay&SessionId_0007
Device Name: Microsoft Remote Display Adapter
Class ID: {4d36e968-e325-11ce-bfc1-08002be10318}
Class Name: Display
Vendor IDs: RdpIdd_IndirectDisplay
Compatible IDs: RdpIdd_IndirectDisplay SWD\Generic
Location Information: -
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 2272

#90 2026-09-29 20:34:33

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Control\Class\{4d36e96e-e325-11ce-bfc1-08002be10318}\0007\DriverVersion

Details: 10.0.26100.1150
Event Type: SetValue
Image: System
Process GUID: {88ea2655-9c98-6ab2-eb03-000000000000}
Process ID: 4
Target Object: HKLM\System\CurrentControlSet\Control\Class\{4d36e96e-e325-11ce-bfc1-08002be10318}\0007\DriverVersion
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:33.852
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#91 2026-09-29 20:34:33

A new external device was recognized by the system (6416 "Security")

192.168.0.225

SP.socpedia.net

SP$

Device Name

Generic Monitor

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Device ID: DISPLAY\Default_Monitor\1&5771b5a&0&UID256
Device Name: Generic Monitor
Class ID: {4d36e96e-e325-11ce-bfc1-08002be10318}
Class Name: Monitor
Vendor IDs: MONITOR\Remote_Monitor
Compatible IDs: *PNP09FF
Location Information: -
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 6468

#92 2026-09-29 20:34:33

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Enum\DISPLAY\Default_Monitor\1&5771b5a&0&UID256\FriendlyName

Details: @System32\drivers\dxgkrnl.sys,#300;Generic Monitor
Event Type: SetValue
Image: System
Process GUID: {88ea2655-9c98-6ab2-eb03-000000000000}
Process ID: 4
Target Object: HKLM\System\CurrentControlSet\Enum\DISPLAY\Default_Monitor\1&5771b5a&0&UID256\FriendlyName
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:33.855
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#93 2026-09-29 20:34:33

CreateRemoteThread detected (8 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

Window Manager\DWM-7

Target Image

C:\Windows\System32\csrss.exe

New Thread ID: 352
Source Image: C:\Windows\System32\dwm.exe
Source Process GUID: {88ea2655-da89-6abb-b91d-000000000700}
Source Process ID: 5756
Source User: Window Manager\DWM-7
Start Address: 0xFFFFF8066692D600
Start Function: -
Start Module: -
Target Image: C:\Windows\System32\csrss.exe
Target Process GUID: {88ea2655-da88-6abb-b21d-000000000700}
Target Process ID: 5204
Target User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:33.866
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#94 2026-09-29 20:34:34

Special privileges assigned to new logon (4672 "Security")

192.168.0.225

SP.socpedia.net

SYSTEM

Privileges

SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege

Subject: Security ID: S-1-5-18
Subject: Account Name: SYSTEM
Subject: Account Domain: NT AUTHORITY
Subject: Logon ID: 0x3e7
Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Computer: SP.socpedia.net
ProcessPID: 876
IP: 192.168.0.225
ThreadID: 740

#95 2026-09-29 20:34:34

Group membership information (4627 "Security")

192.168.0.225

SP.socpedia.net

SYSTEM

GroupMembership

%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Type: 5
New Logon: Security ID: S-1-5-18
New Logon: Account Name: SYSTEM
New Logon: Account Domain: NT AUTHORITY
New Logon: Logon ID: 0x3e7
GroupMembership: %{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 740

#96 2026-09-29 20:34:34

An account was successfully logged on (4624 "Security")

192.168.0.225

SP.socpedia.net

SYSTEM

Network Information: Source Network Address

-

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Information: Logon Type: 5
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-18
New Logon: Account Name: SYSTEM
New Logon: Account Domain: NT AUTHORITY
New Logon: Logon ID: 0x3e7
Account Information: Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information: Process ID: 0x364
Process Information: Process Name: C:\Windows\System32\services.exe
Network Information: Workstation Name: -
Network Information: Source Network Address: -
Network Information: Client Port: -
Detailed Authentication Information: Logon Process: Advapi
Detailed Authentication Information: Authentication Package: Negotiate
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 740

#97 2026-09-29 20:34:34

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\WINDOWS\System32\svchost.exe -k CameraMonitor

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: -
Target Subject: Account Domain: -
Target Subject: Logon ID: 0x0
Process Information: New Process ID: 0x1c24
Process Information: Creator Process ID: 0x364
Process Information: New Process Name: C:\Windows\System32\svchost.exe
Process Information: Creator Process Name: C:\Windows\System32\services.exe
Process Information: Process Command Line: C:\WINDOWS\System32\svchost.exe -k CameraMonitor
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-16384
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 2272

#98 2026-09-29 20:34:34

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Command Line

C:\WINDOWS\System32\svchost.exe -k CameraMonitor

Command Line: C:\WINDOWS\System32\svchost.exe -k CameraMonitor
Image: C:\Windows\System32\svchost.exe
Process GUID: {88ea2655-da8a-6abb-ba1d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: svchost.exe
User: NT AUTHORITY\SYSTEM
Parent Command Line: C:\WINDOWS\system32\services.exe
Parent Image: C:\Windows\System32\services.exe
Parent Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID: {88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID: 0x3e7
Integrity Level: System
Process ID: 7204
Parent Process ID: 868
Terminal Session ID: 0
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#99 2026-09-29 20:34:34

Special privileges assigned to new logon (4672 "Security")

192.168.0.225

SP.socpedia.net

SYSTEM

Privileges

SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege

Subject: Security ID: S-1-5-18
Subject: Account Name: SYSTEM
Subject: Account Domain: NT AUTHORITY
Subject: Logon ID: 0x3e7
Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Computer: SP.socpedia.net
ProcessPID: 876
IP: 192.168.0.225
ThreadID: 7792

#100 2026-09-29 20:34:34

An account was successfully logged on (4624 "Security")

192.168.0.225

SP.socpedia.net

SYSTEM

Network Information: Source Network Address

-

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Information: Logon Type: 5
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-18
New Logon: Account Name: SYSTEM
New Logon: Account Domain: NT AUTHORITY
New Logon: Logon ID: 0x3e7
Account Information: Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information: Process ID: 0x364
Process Information: Process Name: C:\Windows\System32\services.exe
Network Information: Workstation Name: -
Network Information: Source Network Address: -
Network Information: Client Port: -
Detailed Authentication Information: Logon Process: Advapi
Detailed Authentication Information: Authentication Package: Negotiate
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

Оқиға атауы
Оқиға ID
Access Request Information: Access Mask
Access Request Information: Accesses
Account Information: Logon GUID
Account Whose Credentials Were Used: Logon GUID
Action Name
Added Rule: Rule ID
Additional Information: Pre-Authentication Type
Additional Information: Privileges
Additional Information: Ticket Options
Binary
Call Trace
Calling Process Name
Certificate Information: Certificate Issuer Name
Certificate Information: Certificate Serial Number
Certificate Information: Certificate Thumbprint
Class ID
Class Name
Client certificate thumbprint
ClientMachine
Code
Compatible IDs
Component
Computer
Computer Account That Was Changed: Account Name
Connection ID
Connection Type
Count Of Credentials Returned
Creation UTC Time
Creator Subject: Account Domain
Creator Subject: Logon ID
Creator Subject: Security ID
Cryptographic Parameters: Algorithm Name
Cryptographic Parameters: Key Name
Cryptographic Parameters: Key Type
Cryptographic Parameters: Provider Name
Current Directory
DestinationHostname
DestinationIp
DestinationIsIpv6
DestinationPort
DestinationPortName
Detailed Authentication Information: Authentication Package
Details
Device
Device ID
Device Name
Domain
Engine PID
Event Type
Failure Information: Status
Granted Access
Group: Group Domain
Group: Security ID
GroupMembership
Hashes
Host Process
Id
Image
ImpersonationLevel
Initiated
Instance ID
Instance Name
Integrity Level
IP
Is Executable
Key File Operation Information: File Path
Key File Operation Information: Operation
Listener Name
Local Address
Location Information
Logon ID
Logon Information: Remote Credential Guard
Logon Information: Restricted Admin Mode
Logon Process Name
Logon Type
Network Information: Client Address
Network Information: Object Type
Network Information: Port
Network Information: Workstation Name
New Logon: Logon ID
New Thread ID
Object: Handle ID
Object: Object Name
Object: Object Server
Original File Name
Other Information: FQDN
Other Information: ParentProcessId
Other Information: ProcessCreationTime
Other Information: RpcCallClientLocality
param1
param2
Param3
Parent Command Line
Parent Image
Parent Process GUID
Parent Process Name
Parent User
Path
Port Origin
PossibleCause
Previous Creation UTC Time
Priority
Process
Process Creation Time
Process GUID
Process ID
Process Information: Caller Process ID
Process Information: Mandatory Label
Process Information: New Process ID
Process Information: New Process Name
Process Information: Process Command Line
Process Information: Process Creation Time
Process Information: Process ID
Process Information: Process ID
Process Information: Process Name
Process Information: Token Elevation Type
ProcessPID
Profile Changed
Protocol
Provider Path
Query Name
Query Results
Query Status
Remote Address
Result Code
Return Code
RuleName
Server name
Service Host Tag
Service Information: Service Account
Service Information: Service File Name
Service Information: Service Name
Service Information: Service Start Type
Service Information: Service Type
Service: Service Name
ServiceSid
Session ID
Share Information: Share Name
Share Information: Share Path
Source Image
Source Network Address
Source Process GUID
Source Process GUID
Source Process ID
Source Thread ID
Source User
SourceHostname
SourceIp
SourceIsIpv6
SourcePort
SourcePortName
Start Address
Start Function
Start Module
Subject: Account Name
Subject: Read Operation
Subject: Security ID
Target Filename
Target Image
Target Name
Target Object
Target Process GUID
Target Process GUID
Target Process ID
Target Server: Additional Information
Target Server: Target Server Name
Target User
Task Information: Task Name
Task Information: Task New Content
Task Instance ID
Terminal Session ID
ThreadID
Ticket information: Request ticket hash
Ticket information: Response ticket hash
Ticket information: Response ticket hash
TicketEncryptionType
Transmitted Services
TS ID
Type
User
User
User
User Context
User SID
UTC Time
Vendor IDs