Жүктелуде...
SOCpedia Logo SOCpedia
Таймлайндар

Kerberos аутентификациясы

704 29.09.2026 20:50
  1. ws2025.socpedia.net жұмыс станциясынан RDP арқылы sp.socpedia.net серверіне домендік есептік жазбасы lacaladmin-пен қате құпиясөзбен қосыламыз.
  2. ws2025.socpedia.net жұмыс станциясынан RDP арқылы sp.socpedia.net серверіне домендік есептік жазбасы lacaladmin-пен дұрыс құпиясөзбен қосыламыз.

  3. sp.socpedia.net жұмыс станциясында localadmin есептік жазбасын шығару (Sign out) орындаймыз. 

    Сары түспен белгіленген оқиғалар әрекетті талдауда ең қызықтыратындарды көрсетеді.

Фильтрді тазалау
Табылған оқиғалар: 492 / Барлық оқиғалар: 492
#301 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EE202E5C-C6C8-4E57-99DA-5B47E559815A}\DynamicInfo
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EE202E5C-C6C8-4E57-99DA-5B47E559815A}\DynamicInfo
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:36.783
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#302 2026-09-29 20:34:36

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Target Filename
C:\Users\localadmin\AppData\Local\Microsoft\Windows\Notifications\WPNPRMRY.tmp
Creation UTC Time
2026-09-28 16:29:13.651
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-da8c-6abb-c41d-000000000700}
Process ID
8364
Target Filename
C:\Users\localadmin\AppData\Local\Microsoft\Windows\Notifications\WPNPRMRY.tmp
User
SOCPEDIA\localadmin
UTC Time
2026-09-29 15:34:36.936
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#303 2026-09-29 20:34:36

Action success (201 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\TextServicesFramework\MsCtfMonitor
Task Information: Task Name
\Microsoft\Windows\TextServicesFramework\MsCtfMonitor
Task Instance ID
{86c05b6c-e0dc-4e5a-9f90-4519dbd2a351}
Action Name
MsCtfMonitor task handler
Result Code
0
Engine PID
5700
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
5668
#304 2026-09-29 20:34:36

Task success event (102 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\TextServicesFramework\MsCtfMonitor
Task Information: Task Name
\Microsoft\Windows\TextServicesFramework\MsCtfMonitor
User Context
SOCPEDIA\localadmin
Instance ID
{86c05b6c-e0dc-4e5a-9f90-4519dbd2a351}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
5668
#305 2026-09-29 20:34:37

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B43A1E6-1A57-42A0-9D94-B54028D5B833}\DynamicInfo
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B43A1E6-1A57-42A0-9D94-B54028D5B833}\DynamicInfo
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:37.000
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#306 2026-09-29 20:34:37

Key file operation (5058 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Cryptographic Parameters: Key Name
Microsoft Connected Devices Platform device certificate
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xa1beca3
Process Information: Process ID
428
Process Information: Process Creation Time
2026-09-29T15:34:36.3349398Z
Cryptographic Parameters: Provider Name
Microsoft Software Key Storage Provider
Cryptographic Parameters: Algorithm Name
UNKNOWN
Cryptographic Parameters: Key Name
Microsoft Connected Devices Platform device certificate
Cryptographic Parameters: Key Type
%%2500
Key File Operation Information: File Path
C:\Users\localadmin\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_88ea2655-3897-468e-b81f-e7298b4703f2
Key File Operation Information: Operation
%%2458
Key File Operation Information: Return Code
0x0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#307 2026-09-29 20:34:37

Cryptographic operation (5061 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Cryptographic Parameters: Key Name
Microsoft Connected Devices Platform device certificate
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xa1beca3
Cryptographic Parameters: Provider Name
Microsoft Software Key Storage Provider
Cryptographic Parameters: Algorithm Name
ECDSA_P256
Cryptographic Parameters: Key Name
Microsoft Connected Devices Platform device certificate
Cryptographic Parameters: Key Type
%%2500
Key File Operation Information: Operation
%%2480
Key File Operation Information: Return Code
0x0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#308 2026-09-29 20:34:37

Key migration operation (5059 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Cryptographic Parameters: Key Name
Microsoft Connected Devices Platform device certificate
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xa1beca3
Client Process ID
428
Process Information: Process Creation Time
2026-09-29T15:34:36.3349398Z
Cryptographic Parameters: Provider Name
Microsoft Software Key Storage Provider
Cryptographic Parameters: Algorithm Name
ECDSA_P256
Cryptographic Parameters: Key Name
Microsoft Connected Devices Platform device certificate
Cryptographic Parameters: Key Type
%%2500
Key File Operation Information: Operation
%%2464
Key File Operation Information: Return Code
0x0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#309 2026-09-29 20:34:37

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
DestinationIp
13.69.109.131
DestinationHostname
-
DestinationIp
13.69.109.131
DestinationIsIpv6
false
DestinationPort
443
DestinationPortName
https
Image
C:\Windows\System32\svchost.exe
Initiated
true
Process GUID
{88ea2655-9cae-6ab2-4000-000000000700}
Process ID
3352
Protocol
tcp
RuleName
v1-0_eventID3
SourceHostname
SP.socpedia.net
SourceIp
192.168.0.225
SourceIsIpv6
false
SourcePort
49156
SourcePortName
-
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:35:34.554
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4272
#310 2026-09-29 20:34:37

Task success event (102 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\Plug and Play\Device Install Reboot Required
Task Information: Task Name
\Microsoft\Windows\Plug and Play\Device Install Reboot Required
User Context
SOCPEDIA\localadmin
Instance ID
{d1735e78-2133-48f0-94da-5b920de9f4c7}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
5668
#311 2026-09-29 20:34:37

Action success (201 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\Plug and Play\Device Install Reboot Required
Task Information: Task Name
\Microsoft\Windows\Plug and Play\Device Install Reboot Required
Task Instance ID
{d1735e78-2133-48f0-94da-5b920de9f4c7}
Action Name
Device Installation Reboot Dialog Task
Result Code
0
Engine PID
268
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
5668
#312 2026-09-29 20:34:37

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EA397B2-B342-49F2-BE2B-D0916F251460}\DynamicInfo
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EA397B2-B342-49F2-BE2B-D0916F251460}\DynamicInfo
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:37.383
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#313 2026-09-29 20:34:37

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\System32\taskhostw.exe
Image
C:\Windows\System32\taskhostw.exe
Process GUID
{88ea2655-da8c-6abb-c61d-000000000700}
Process ID
268
User
SOCPEDIA\localadmin
UTC Time
2026-09-29 15:34:37.424
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#314 2026-09-29 20:34:37

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\userinit.exe
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0xbc8
Process Information: Creator Process ID
0x1714
Process Information: New Process Name
C:\Windows\System32\userinit.exe
Process Information: Creator Process Name
C:\Windows\System32\winlogon.exe
Process Information: Process Command Line
C:\WINDOWS\system32\userinit.exe
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#315 2026-09-29 20:34:37

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\WINDOWS\system32\userinit.exe
Command Line
C:\WINDOWS\system32\userinit.exe
Image
C:\Windows\System32\userinit.exe
Process GUID
{88ea2655-da8d-6abb-c91d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
USERINIT.EXE
User
SOCPEDIA\localadmin
Parent Command Line
winlogon.exe
Parent Image
C:\Windows\System32\winlogon.exe
Parent Process GUID
{88ea2655-da88-6abb-b31d-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=BF6A5A25B5B95A80DE78F1C00AF38CAAC590101A,SHA256=5BDD4FDEF7916B31154225869D5EA207351C90E80DA437286B82B778B2B42C39,IMPHASH=831F09A183825FCD04B27DF4080A7582
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
3016
Parent Process ID
5908
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#316 2026-09-29 20:34:37

The service entered the stopped state (7036 "System")

192.168.0.225
SP.socpedia.net
param1
App Readiness
Binary
410070007000520065006100640069006E006500730073002F0031000000
param1
App Readiness
param2
stopped
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
868
ThreadID
8808
#317 2026-09-29 20:34:37

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Image
C:\Windows\System32\svchost.exe
Image
C:\Windows\System32\svchost.exe
Process GUID
{88ea2655-d835-6abb-751d-000000000700}
Process ID
5948
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:37.740
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#318 2026-09-29 20:34:37

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Process Information: Process Command Line
"C:\Windows\System32\ShellHost.exe"
Creator Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Creator Subject: Account Name
localadmin
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0xa1beca3
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x1d7c
Process Information: Creator Process ID
0x1ae8
Process Information: New Process Name
C:\Windows\System32\ShellHost.exe
Process Information: Creator Process Name
C:\Windows\System32\sihost.exe
Process Information: Process Command Line
"C:\Windows\System32\ShellHost.exe"
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
6468
#319 2026-09-29 20:34:37

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
"C:\Windows\System32\ShellHost.exe"
Command Line
"C:\Windows\System32\ShellHost.exe"
Image
C:\Windows\System32\ShellHost.exe
Process GUID
{88ea2655-da8d-6abb-ca1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
ShellHost.exe
User
SOCPEDIA\localadmin
Parent Command Line
sihost.exe
Parent Image
C:\Windows\System32\sihost.exe
Parent Process GUID
{88ea2655-da8c-6abb-c21d-000000000700}
Parent User
SOCPEDIA\localadmin
Hashes
SHA1=0CE279441490F4F7E5FA94986F1CC5B65CA35CD4,SHA256=E856AD23315CEFCCB2E5ED275E683BAF108F85BDC19015667F64828EC78C62E4,IMPHASH=F284D0D726FB0C6E0CEDFAEE0F2F2797
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
7548
Parent Process ID
6888
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#320 2026-09-29 20:34:37

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Process Information: Process Command Line
C:\WINDOWS\Explorer.EXE
Creator Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Creator Subject: Account Name
localadmin
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0xa1beca3
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x23e4
Process Information: Creator Process ID
0xbc8
Process Information: New Process Name
C:\Windows\explorer.exe
Process Information: Creator Process Name
C:\Windows\System32\userinit.exe
Process Information: Process Command Line
C:\WINDOWS\Explorer.EXE
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#321 2026-09-29 20:34:37

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\WINDOWS\Explorer.EXE
Command Line
C:\WINDOWS\Explorer.EXE
Image
C:\Windows\explorer.exe
Process GUID
{88ea2655-da8d-6abb-cb1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
EXPLORER.EXE
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\userinit.exe
Parent Image
C:\Windows\System32\userinit.exe
Parent Process GUID
{88ea2655-da8d-6abb-c91d-000000000700}
Parent User
SOCPEDIA\localadmin
Hashes
SHA1=8AC453AD7BBE88D8B779EE7B5CD7A7B44DAC115F,SHA256=75A58FED6D38498775EC288FF7DA54209C47CEA2625F7EAEDF15EF2D0E6C1ADD,IMPHASH=ED26D175FFBF8896454AC1E811E787B5
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
9188
Parent Process ID
3016
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#322 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
Details
DWORD (0x00000003)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.374
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#323 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\SD
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\SD
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.372
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#324 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
Details
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.374
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#325 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
Details
D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.374
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#326 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
Details
DWORD (0x00010002)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.374
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#327 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.375
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#328 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.374
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#329 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.375
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#330 2026-09-29 20:34:38

Task registration updated (140 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
S-1-5-18
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
UserName
S-1-5-18
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
6896
#331 2026-09-29 20:34:38

A scheduled task was updated (4702 "Security")

192.168.0.225
SP.socpedia.net
SP$
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Task Information: Task New Content
<?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <URI>\Microsoft\Windows\UpdateOrchestrator\Schedule Work</URI> <SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)</SecurityDescriptor> </RegistrationInfo> <Triggers> <TimeTrigger> <StartBoundary>2026-09-29T21:38:27.783Z</StartBoundary> <Enabled>true</Enabled> </TimeTrigger> </Triggers> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>S-1-5-18</UserId> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <Duration>PT10M</Duration> <WaitTimeout>PT1H</WaitTimeout> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>PT72H</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>%systemroot%\system32\usoclient.exe</Command> <Arguments>StartWork</Arguments> </Exec> </Actions> </Task>
Other Information: ProcessCreationTime
1970324836974741
Other Information: ClientProcessId
3604
Other Information: ParentProcessId
2796
Other Information: RpcCallClientLocality
0
Other Information: FQDN
SP.socpedia.net
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#332 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.400
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#333 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
Details
DWORD (0x00000003)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.400
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#334 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
Details
D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.401
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#335 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
Details
DWORD (0x00010002)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.400
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#336 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.401
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#337 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
Details
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.401
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#338 2026-09-29 20:34:38

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:38.401
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#339 2026-09-29 20:34:38

Task registration updated (140 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\SP$
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
UserName
SOCPEDIA\SP$
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
6896
#340 2026-09-29 20:34:38

A scheduled task was updated (4702 "Security")

192.168.0.225
SP.socpedia.net
SP$
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Task Information: Task New Content
<?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <URI>\Microsoft\Windows\UpdateOrchestrator\Schedule Work</URI> <SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)</SecurityDescriptor> </RegistrationInfo> <Triggers> <TimeTrigger> <StartBoundary>2026-09-29T21:38:27.783Z</StartBoundary> <Enabled>true</Enabled> </TimeTrigger> </Triggers> <Principals> <Principal id="Author"> <UserId>S-1-5-18</UserId> <RunLevel>LeastPrivilege</RunLevel> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <Duration>PT10M</Duration> <WaitTimeout>PT1H</WaitTimeout> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>PT72H</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>%systemroot%\system32\usoclient.exe</Command> <Arguments>StartWork</Arguments> </Exec> </Actions> </Task>
Other Information: ProcessCreationTime
1970324836982207
Other Information: ClientProcessId
4880
Other Information: ParentProcessId
868
Other Information: RpcCallClientLocality
0
Other Information: FQDN
SP.socpedia.net
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#341 2026-09-29 20:34:38

Group membership information (4627 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Type
5
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#342 2026-09-29 20:34:38

An account was successfully logged on (4624 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
Network Information: Source Network Address
-
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Information: Logon Type
5
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
Account Information: Logon GUID
{00000000-0000-0000-0000-000000000000}
Process Information: Process ID
0x364
Process Information: Process Name
C:\Windows\System32\services.exe
Network Information: Workstation Name
-
Network Information: Source Network Address
-
Network Information: Client Port
-
Detailed Authentication Information: Logon Process
Advapi
Detailed Authentication Information: Authentication Package
Negotiate
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#343 2026-09-29 20:34:38

Special privileges assigned to new logon (4672 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
Privileges
SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Subject: Security ID
S-1-5-18
Subject: Account Name
SYSTEM
Subject: Account Domain
NT AUTHORITY
Subject: Logon ID
0x3e7
Privileges
SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Computer
SP.socpedia.net
ProcessPID
876
IP
192.168.0.225
ThreadID
740
#344 2026-09-29 20:34:38

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\System32\svchost.exe -k AppReadiness -p -s AppReadiness
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x66c
Process Information: Creator Process ID
0x364
Process Information: New Process Name
C:\Windows\System32\svchost.exe
Process Information: Creator Process Name
C:\Windows\System32\services.exe
Process Information: Process Command Line
C:\WINDOWS\System32\svchost.exe -k AppReadiness -p -s AppReadiness
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
6468
#345 2026-09-29 20:34:38

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
C:\WINDOWS\System32\svchost.exe -k AppReadiness -p -s AppReadiness
Command Line
C:\WINDOWS\System32\svchost.exe -k AppReadiness -p -s AppReadiness
Image
C:\Windows\System32\svchost.exe
Process GUID
{88ea2655-da8e-6abb-cc1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
svchost.exe
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\system32\services.exe
Parent Image
C:\Windows\System32\services.exe
Parent Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID
{88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
1644
Parent Process ID
868
Terminal Session ID
0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#346 2026-09-29 20:34:38

The service entered the stopped state (7036 "System")

192.168.0.225
SP.socpedia.net
param1
App Readiness
Binary
410070007000520065006100640069006E006500730073002F0034000000
param1
App Readiness
param2
running
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
868
ThreadID
8424
#347 2026-09-29 20:34:38

Group membership information (4627 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Type
5
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#348 2026-09-29 20:34:38

An account was successfully logged on (4624 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
Network Information: Source Network Address
-
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Information: Logon Type
5
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
Account Information: Logon GUID
{00000000-0000-0000-0000-000000000000}
Process Information: Process ID
0x364
Process Information: Process Name
C:\Windows\System32\services.exe
Network Information: Workstation Name
-
Network Information: Source Network Address
-
Network Information: Client Port
-
Detailed Authentication Information: Logon Process
Advapi
Detailed Authentication Information: Authentication Package
Negotiate
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#349 2026-09-29 20:34:38

Special privileges assigned to new logon (4672 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
Privileges
SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Subject: Security ID
S-1-5-18
Subject: Account Name
SYSTEM
Subject: Account Domain
NT AUTHORITY
Subject: Logon ID
0x3e7
Privileges
SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Computer
SP.socpedia.net
ProcessPID
876
IP
192.168.0.225
ThreadID
5672
#350 2026-09-29 20:34:38

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x17b0
Process Information: Creator Process ID
0x364
Process Information: New Process Name
C:\Windows\System32\svchost.exe
Process Information: Creator Process Name
C:\Windows\System32\services.exe
Process Information: Process Command Line
C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7604
#351 2026-09-29 20:34:38

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC
Command Line
C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC
Image
C:\Windows\System32\svchost.exe
Process GUID
{88ea2655-da8e-6abb-cd1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
svchost.exe
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\system32\services.exe
Parent Image
C:\Windows\System32\services.exe
Parent Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID
{88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
6064
Parent Process ID
868
Terminal Session ID
0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#352 2026-09-29 20:34:38

Operation started operational (5857 "Microsoft-Windows-WMI-Activity/Operational")

192.168.0.225
SP.socpedia.net
Provider Name
WMIProv
Provider Name
WMIProv
Code
0x0
Host Process
wmiprvse.exe
Process ID
5312
Provider Path
%systemroot%\system32\wbem\wmiprov.dll
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
5312
ThreadID
5260
#353 2026-09-29 20:34:38

The service entered the stopped state (7036 "System")

192.168.0.225
SP.socpedia.net
param1
Client License Service (ClipSVC)
Binary
43006C00690070005300560043002F0034000000
param1
Client License Service (ClipSVC)
param2
running
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
868
ThreadID
6508
#354 2026-09-29 20:34:38

Operation client failure (5858 "Microsoft-Windows-WMI-Activity/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Key File Operation Information: Operation
Start IWbemServices::ExecQuery - root\WMI : SELECT * FROM WmiMonitorID
Id
{00000000-0000-0000-0000-000000000000}
ClientMachine
SP
User
NT AUTHORITY\SYSTEM
Client Process ID
8300
Component
Unknown
Key File Operation Information: Operation
Start IWbemServices::ExecQuery - root\WMI : SELECT * FROM WmiMonitorID
Result Code
0x8004100c
PossibleCause
Unknown
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3460
ThreadID
3240
#355 2026-09-29 20:34:39

File Delete logged (26 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Filename
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-Server-2025-Standard-Evaluation.swidtag
UTC Time
2026-09-29 15:34:39.030
Process GUID
{88ea2655-da8e-6abb-cd1d-000000000700}
Process ID
6064
User
NT AUTHORITY\SYSTEM
Image
C:\WINDOWS\System32\svchost.exe
Target Filename
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-Server-2025-Standard-Evaluation.swidtag
Hashes
SHA1=3484BD8B82C179996BFCC17C2D51D4567B7B0D3A,SHA256=0A819C988DD6CB35D5C9ACB6F56BEF6460653E832C3461D3836907891D9799F3,IMPHASH=00000000000000000000000000000000
Is Executable
false
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#356 2026-09-29 20:34:39

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Filename
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-Server-2025-Standard-Evaluation.swidtag
Creation UTC Time
2026-08-18 11:37:14.577
Image
C:\WINDOWS\System32\svchost.exe
Process GUID
{88ea2655-da8e-6abb-cd1d-000000000700}
Process ID
6064
Target Filename
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-Server-2025-Standard-Evaluation.swidtag
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.032
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#357 2026-09-29 20:34:39

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Filename
C:\ProgramData\Microsoft\Windows\AppRepository\05278b55-3162-4e06-b252-8b75433ca0fa_S-1-5-21-1838030176-2987033226-1986555923-1140_1.rslc
Creation UTC Time
2026-09-29 15:34:39.066
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-da03-6abb-ad1d-000000000700}
Process ID
1104
Target Filename
C:\ProgramData\Microsoft\Windows\AppRepository\05278b55-3162-4e06-b252-8b75433ca0fa_S-1-5-21-1838030176-2987033226-1986555923-1140_1.rslc
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.067
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#358 2026-09-29 20:34:39

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
rundll32.exe AppXDeploymentExtensions.OneCore.dll,ShellRefresh
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x2290
Process Information: Creator Process ID
0x450
Process Information: New Process Name
C:\Windows\System32\rundll32.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
rundll32.exe AppXDeploymentExtensions.OneCore.dll,ShellRefresh
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#359 2026-09-29 20:34:39

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Filename
C:\Windows\AppReadiness\S-1-5-21-1838030176-2987033226-1986555923-1140
Creation UTC Time
2026-09-29 15:34:39.090
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-da03-6abb-ad1d-000000000700}
Process ID
1104
Target Filename
C:\Windows\AppReadiness\S-1-5-21-1838030176-2987033226-1986555923-1140
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.091
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#360 2026-09-29 20:34:39

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
rundll32.exe AppXDeploymentExtensions.OneCore.dll,ShellRefresh
Command Line
rundll32.exe AppXDeploymentExtensions.OneCore.dll,ShellRefresh
Image
C:\Windows\System32\rundll32.exe
Process GUID
{88ea2655-da8f-6abb-ce1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
RUNDLL32.EXE
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-da03-6abb-ad1d-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=DEF4011B5536983285472BA75C22C6A2410EDF6A,SHA256=4B84DC6750937EB47B19CDE0D23DEBD4D2F2211300171B36D13EF5AD11DD60F9,IMPHASH=E3165C22028490334195CBDFA2962AA1
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
8848
Parent Process ID
1104
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#361 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\SD
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\SD
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.146
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#362 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.149
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#363 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
Details
DWORD (0x00000003)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.149
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#364 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
Details
DWORD (0x00010002)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.149
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#365 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
Details
D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.149
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#366 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.149
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#367 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
Details
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.149
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#368 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.149
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#369 2026-09-29 20:34:39

Task registration updated (140 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
S-1-5-18
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
UserName
S-1-5-18
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
5668
#370 2026-09-29 20:34:39

A scheduled task was updated (4702 "Security")

192.168.0.225
SP.socpedia.net
SP$
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Task Information: Task New Content
<?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <URI>\Microsoft\Windows\UpdateOrchestrator\Schedule Work</URI> <SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)</SecurityDescriptor> </RegistrationInfo> <Triggers> <TimeTrigger> <StartBoundary>2026-09-29T21:38:27.783Z</StartBoundary> <Enabled>true</Enabled> </TimeTrigger> </Triggers> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>S-1-5-18</UserId> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <Duration>PT10M</Duration> <WaitTimeout>PT1H</WaitTimeout> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>PT72H</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>%systemroot%\system32\usoclient.exe</Command> <Arguments>StartWork</Arguments> </Exec> </Actions> </Task>
Other Information: ProcessCreationTime
1970324836974741
Other Information: ClientProcessId
3604
Other Information: ParentProcessId
2796
Other Information: RpcCallClientLocality
0
Other Information: FQDN
SP.socpedia.net
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#371 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
Details
DWORD (0x00000003)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.193
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#372 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
Details
DWORD (0x00010002)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.193
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#373 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.193
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#374 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
Details
D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.193
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#375 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
Details
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.193
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#376 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.193
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#377 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.193
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#378 2026-09-29 20:34:39

A scheduled task was updated (4702 "Security")

192.168.0.225
SP.socpedia.net
SP$
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Task Information: Task New Content
<?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <URI>\Microsoft\Windows\UpdateOrchestrator\Schedule Work</URI> <SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)</SecurityDescriptor> </RegistrationInfo> <Triggers> <TimeTrigger> <StartBoundary>2026-09-29T21:38:27.783Z</StartBoundary> <Enabled>true</Enabled> </TimeTrigger> </Triggers> <Principals> <Principal id="Author"> <UserId>S-1-5-18</UserId> <RunLevel>LeastPrivilege</RunLevel> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <Duration>PT10M</Duration> <WaitTimeout>PT1H</WaitTimeout> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>PT72H</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>%systemroot%\system32\usoclient.exe</Command> <Arguments>StartWork</Arguments> </Exec> </Actions> </Task>
Other Information: ProcessCreationTime
1970324836982207
Other Information: ClientProcessId
4880
Other Information: ParentProcessId
868
Other Information: RpcCallClientLocality
0
Other Information: FQDN
SP.socpedia.net
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#379 2026-09-29 20:34:39

Task registration updated (140 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\SP$
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
UserName
SOCPEDIA\SP$
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
5668
#380 2026-09-29 20:34:39

Task success event (102 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies
Task Information: Task Name
\Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies
User Context
SOCPEDIA\localadmin
Instance ID
{88ce242d-6911-47fa-a58b-3d9557893b8b}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
6896
#381 2026-09-29 20:34:39

Action success (201 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies
Task Information: Task Name
\Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies
Task Instance ID
{88ce242d-6911-47fa-a58b-3d9557893b8b}
Action Name
NcsiIdentifyUserProxiesTask
Result Code
0
Engine PID
6200
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
6896
#382 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{92505DE7-B1EC-4D5B-AA6A-2B441117E270}\DynamicInfo
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{92505DE7-B1EC-4D5B-AA6A-2B441117E270}\DynamicInfo
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.252
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#383 2026-09-29 20:34:39

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Filename
C:\ProgramData\Microsoft\Windows\AppRepository\05278b55-3162-4e06-b252-8b75433ca0fa_S-1-5-21-1838030176-2987033226-1986555923-1140_1.rslc
Creation UTC Time
2026-09-29 15:34:39.066
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-da03-6abb-ad1d-000000000700}
Process ID
1104
Target Filename
C:\ProgramData\Microsoft\Windows\AppRepository\05278b55-3162-4e06-b252-8b75433ca0fa_S-1-5-21-1838030176-2987033226-1986555923-1140_1.rslc
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.259
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#384 2026-09-29 20:34:39

Task failure event (103 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\WindowsColorSystem\Calibration Loader
Task Information: Task Name
\Microsoft\Windows\WindowsColorSystem\Calibration Loader
Instance ID
{62f0fc02-7049-4073-b4ae-f4c1b1ea7009}
User Context
SOCPEDIA\localadmin
Result Code
2147500037
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
6896
#385 2026-09-29 20:34:39

Action failure (202 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\WindowsColorSystem\Calibration Loader
Task Information: Task Name
\Microsoft\Windows\WindowsColorSystem\Calibration Loader
Task Instance ID
{62f0fc02-7049-4073-b4ae-f4c1b1ea7009}
Action Name
Color Calibration Loader
Result Code
2147500037
Engine PID
6200
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
6896
#386 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15DD8453-F3D8-4527-B538-E2365179F5BB}\DynamicInfo
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15DD8453-F3D8-4527-B538-E2365179F5BB}\DynamicInfo
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.283
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#387 2026-09-29 20:34:39

Task success event (102 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\CertificateServicesClient\UserTask
Task Information: Task Name
\Microsoft\Windows\CertificateServicesClient\UserTask
User Context
SOCPEDIA\localadmin
Instance ID
{1db1f90b-928a-42bd-a7b4-6eb556f08c21}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
6896
#388 2026-09-29 20:34:39

Action success (201 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\CertificateServicesClient\UserTask
Task Information: Task Name
\Microsoft\Windows\CertificateServicesClient\UserTask
Task Instance ID
{1db1f90b-928a-42bd-a7b4-6eb556f08c21}
Action Name
Certificate Services Client Task Handler
Result Code
0
Engine PID
6200
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
6896
#389 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A60EE6FD-40BA-4476-8AF0-1787C15F6A88}\DynamicInfo
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A60EE6FD-40BA-4476-8AF0-1787C15F6A88}\DynamicInfo
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.295
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#390 2026-09-29 20:34:39

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Image
C:\Windows\System32\taskhostw.exe
Image
C:\Windows\System32\taskhostw.exe
Process GUID
{88ea2655-da8c-6abb-c51d-000000000700}
Process ID
6200
User
SOCPEDIA\localadmin
UTC Time
2026-09-29 15:34:39.321
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#391 2026-09-29 20:34:39

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Image
C:\Windows\System32\ctfmon.exe
Image
C:\Windows\System32\ctfmon.exe
Process GUID
{88ea2655-da8a-6abb-bd1d-000000000700}
Process ID
6932
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.356
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#392 2026-09-29 20:34:39

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Image
C:\Windows\System32\provtool.exe
Image
C:\Windows\System32\provtool.exe
Process GUID
{88ea2655-da8c-6abb-c81d-000000000700}
Process ID
5156
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.492
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#393 2026-09-29 20:34:39

Action success (201 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\Management\Provisioning\Logon
Task Information: Task Name
\Microsoft\Windows\Management\Provisioning\Logon
Task Instance ID
{3aa70e95-f2e6-420e-a740-d991eaafe554}
Action Name
%windir%\system32\ProvTool.exe
Result Code
0
Engine PID
5156
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
6896
#394 2026-09-29 20:34:39

Task success event (102 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225
SP.socpedia.net
Task Information: Task Name
\Microsoft\Windows\Management\Provisioning\Logon
Task Information: Task Name
\Microsoft\Windows\Management\Provisioning\Logon
User Context
NT AUTHORITY\SYSTEM
Instance ID
{3aa70e95-f2e6-420e-a740-d991eaafe554}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
2408
ThreadID
6896
#395 2026-09-29 20:34:39

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EE202E5C-C6C8-4E57-99DA-5B47E559815A}\DynamicInfo
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EE202E5C-C6C8-4E57-99DA-5B47E559815A}\DynamicInfo
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.496
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#396 2026-09-29 20:34:39

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Filename
C:\ProgramData\Microsoft\Windows\AppRepository\05278b55-3162-4e06-b252-8b75433ca0fa_S-1-5-21-1838030176-2987033226-1986555923-1140_2.rslc
Creation UTC Time
2026-09-29 15:34:39.825
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-da03-6abb-ad1d-000000000700}
Process ID
1104
Target Filename
C:\ProgramData\Microsoft\Windows\AppRepository\05278b55-3162-4e06-b252-8b75433ca0fa_S-1-5-21-1838030176-2987033226-1986555923-1140_2.rslc
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.825
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#397 2026-09-29 20:34:39

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Filename
C:\Windows\AppReadiness\S-1-5-21-1838030176-2987033226-1986555923-1140
Creation UTC Time
2026-09-29 15:34:39.090
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-da03-6abb-ad1d-000000000700}
Process ID
1104
Target Filename
C:\Windows\AppReadiness\S-1-5-21-1838030176-2987033226-1986555923-1140
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:39.879
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#398 2026-09-29 20:34:40

A new process has been created (4688 "Security")

192.168.0.210
DC.socpedia.net
DC$
Process Information: Process Command Line
taskhostw.exe
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
DC$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x19bc
Process Information: Creator Process ID
0x944
Process Information: New Process Name
C:\Windows\System32\taskhostw.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
taskhostw.exe
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
4
ThreadID
3820
#399 2026-09-29 20:34:40

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210
DC.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
taskhostw.exe
Command Line
taskhostw.exe
Image
C:\Windows\System32\taskhostw.exe
Process GUID
{d062d9b1-da90-6abb-ff2b-000000000b00}
Current Directory
C:\WINDOWS\system32\
Original File Name
taskhostw.exe
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{d062d9b1-2871-6aaa-2c00-000000000b00}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=51B30EF11B5D3E8973A4842AD302E775A4BEBF16,SHA256=81B033630F0DF0AF3F6D93FB455B16A31CFEB58960BAE12B5292D91E17D82FCB,IMPHASH=2196268E7A2880E3ADC74481297D0C4B
Logon GUID
{d062d9b1-2864-6aaa-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
6588
Parent Process ID
2372
Terminal Session ID
0
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
3844
ThreadID
832
#400 2026-09-29 20:34:40

Created task process (129 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.210
DC.socpedia.net
Task Information: Task Name
\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Task Information: Task Name
\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Path
taskhostw.exe
Process ID
6588
Priority
16384
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
2372
ThreadID
6452

SOCpedia - білім платформасы

Мұнда SOC және Blue Team тәжірибелері бойынша материалдар жинақталған: мақалалар, жаңалықтар, кітаптар және аудармалар.

Жаңалықтар Блог SOCpedia кітапханасы