434400x80000000000000008703Microsoft-Windows-Sysmon/Operationalsoc101win112025-10-29 13:14:01.696Started15.154.90 13241300x80000000000000008704Microsoft-Windows-Sysmon/Operationalsoc101win11Context,DeviceConnectedOrUpdatedSetValue2025-10-29 13:13:53.424{8223a6b9-1311-6902-eb03-000000000000}4SystemHKLM\System\CurrentControlSet\Control\DeviceClasses\{0a4252a0-7e70-11d0-a5d6-28db04c10000}\##?#ROOT#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}\#{cfd669f1-9bc2-11d0-8299-0000f822fe8a}&{0A4252A0-7E70-11D0-A5D6-28DB04C10000}\Device Parameters\FriendlyNameTee/Sink-to-Sink ConverterNT AUTHORITY\SYSTEM 13241300x80000000000000008705Microsoft-Windows-Sysmon/Operationalsoc101win11Context,DeviceConnectedOrUpdatedSetValue2025-10-29 13:13:53.424{8223a6b9-1311-6902-eb03-000000000000}4SystemHKLM\System\CurrentControlSet\Control\DeviceClasses\{cf1dda2c-9743-11d0-a3ee-00a0c9223196}\##?#ROOT#SYSTEM#0000#{cf1dda2c-9743-11d0-a3ee-00a0c9223196}\#{cfd669f1-9bc2-11d0-8299-0000f822fe8a}&{CF1DDA2C-9743-11D0-A3EE-00A0C9223196}\Device Parameters\FriendlyNameTee/Sink-to-Sink ConverterNT AUTHORITY\SYSTEM 13241300x80000000000000008706Microsoft-Windows-Sysmon/Operationalsoc101win11Context,DeviceConnectedOrUpdatedSetValue2025-10-29 13:13:53.424{8223a6b9-1311-6902-eb03-000000000000}4SystemHKLM\System\CurrentControlSet\Control\DeviceClasses\{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}\##?#ROOT#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}\#{EEC12DB6-AD9C-4168-8658-B03DAEF417FE}&{ABD61E00-9350-47e2-A632-4438B90C6641}\Device Parameters\FriendlyNameMicrosoft Trusted Audio DriversNT AUTHORITY\SYSTEM 11241100x80000000000000008707Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:53.688{8223a6b9-1311-6902-eb03-000000000000}4SystemC:\Windows\System32\drivers\DriverData\LogFiles\WMI\Microsoft-Windows-Rdp-Graphics-RdpIdd-Trace.etl2024-11-11 18:43:29.297NT AUTHORITY\SYSTEM 154100x80000000000000008708Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:56.280{8223a6b9-1314-6902-0500-000000002b00}584C:\Windows\System32\smss.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Session ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationsmss.exe\SystemRoot\System32\smss.exe 000000e8 000000d4 C:\WINDOWS\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4CDDC568D65CFC449790EA114C70C611,SHA256=BDC489C640B6F9ECD345D63A5756598CC89307C7DFFC9B9D0EC414C3740F9EDA,IMPHASH=4E9EC486863D71200EBE8105C18E645B{8223a6b9-1311-6902-0300-000000002b00}460C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exeNT AUTHORITY\SYSTEM 154100x80000000000000008709Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:56.531{8223a6b9-1314-6902-0600-000000002b00}616C:\Windows\System32\csrss.exe10.0.26100.1 (WinBuild.160101.0800)Client Server Runtime ProcessMicrosoft® Windows® Operating SystemMicrosoft CorporationCSRSS.Exe%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=E77E433573B7F629CFA089FFC8626292,SHA256=A958083FD4982697973D1F4A05A8F51B1F5D551A558CFA0097CFB6867FDCE3BA,IMPHASH=2A4F07729AD0B91A59C641DBB9BBB3E7{8223a6b9-1314-6902-0500-000000002b00}584C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000e8 000000d4 NT AUTHORITY\SYSTEM 154100x80000000000000008710Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:56.754{8223a6b9-1314-6902-0700-000000002b00}680C:\Windows\System32\smss.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Session ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationsmss.exe\SystemRoot\System32\smss.exe 000000dc 000000d4 C:\WINDOWS\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e71SystemMD5=4CDDC568D65CFC449790EA114C70C611,SHA256=BDC489C640B6F9ECD345D63A5756598CC89307C7DFFC9B9D0EC414C3740F9EDA,IMPHASH=4E9EC486863D71200EBE8105C18E645B{8223a6b9-1311-6902-0300-000000002b00}460C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exeNT AUTHORITY\SYSTEM 154100x80000000000000008711Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:56.759{8223a6b9-1314-6902-0900-000000002b00}696C:\Windows\System32\csrss.exe10.0.26100.1 (WinBuild.160101.0800)Client Server Runtime ProcessMicrosoft® Windows® Operating SystemMicrosoft CorporationCSRSS.Exe%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e71SystemMD5=E77E433573B7F629CFA089FFC8626292,SHA256=A958083FD4982697973D1F4A05A8F51B1F5D551A558CFA0097CFB6867FDCE3BA,IMPHASH=2A4F07729AD0B91A59C641DBB9BBB3E7{8223a6b9-1314-6902-0700-000000002b00}680C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000dc 000000d4 NT AUTHORITY\SYSTEM 154100x80000000000000008712Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:56.757{8223a6b9-1314-6902-0800-000000002b00}688C:\Windows\System32\wininit.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Start-Up ApplicationMicrosoft® Windows® Operating SystemMicrosoft CorporationWinInit.exewininit.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4F56EC56DA37DFD1096A4AFA41B23D61,SHA256=41AE183FD7BB2CF9335E263A8816F218ACDED9E9379D9C261CEB51DBBE3E6133,IMPHASH=BC0D3E8B8FB1085D75AF638FEBDDD664{8223a6b9-1314-6902-0500-000000002b00}584C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000e8 000000d4 NT AUTHORITY\SYSTEM 154100x80000000000000008713Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:56.796{8223a6b9-1314-6902-0a00-000000002b00}760C:\Windows\System32\winlogon.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Logon ApplicationMicrosoft® Windows® Operating SystemMicrosoft CorporationWINLOGON.EXEwinlogon.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e71SystemMD5=3101780DB9979DE247DF761C79B9C1BA,SHA256=8A6BDCD7D63C058C4244B019FF38DB28362DE953BF12AE6ACA5B618EB221E624,IMPHASH=E69DA191C10719269C8283A2998DB55A{8223a6b9-1314-6902-0700-000000002b00}680C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000dc 000000d4 NT AUTHORITY\SYSTEM 154100x80000000000000008714Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:56.879{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exe10.0.26100.4768 (WinBuild.160101.0800)Services and Controller appMicrosoft® Windows® Operating SystemMicrosoft Corporationservices.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=9D5976750E3185D6876890AFFC4F5D5B,SHA256=58265603924D91BF896ED2CBEA7D0F3605029C3F7E888739A9902E1BF16D7099,IMPHASH=1F4CC1FC2C8E8DD22EB2C6EE9E8734A2{8223a6b9-1314-6902-0800-000000002b00}688C:\Windows\System32\wininit.exewininit.exeNT AUTHORITY\SYSTEM 13241300x80000000000000008715Microsoft-Windows-Sysmon/Operationalsoc101win11T1183,IFEOSetValue2025-10-29 13:13:56.936{8223a6b9-1314-6902-0800-000000002b00}688C:\WINDOWS\system32\wininit.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe\AuditLevelDWORD (0x00000008)NT AUTHORITY\SYSTEM 13241300x80000000000000008716Microsoft-Windows-Sysmon/Operationalsoc101win11T1101SetValue2025-10-29 13:13:56.936{8223a6b9-1314-6902-0800-000000002b00}688C:\WINDOWS\system32\wininit.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLBootDWORD (0x00000002)NT AUTHORITY\SYSTEM 154100x80000000000000008717Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:56.946{8223a6b9-1314-6902-0c00-000000002b00}856C:\Windows\System32\lsass.exe10.0.26100.1882 (WinBuild.160101.0800)Local Security Authority ProcessMicrosoft® Windows® Operating SystemMicrosoft Corporationlsass.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5C800E1EE62A6DEE95FA7043D5964696,SHA256=13249566F8FE00E00D0A0EE85FB18AE109AD28017DF0A622B3872A37932CF958,IMPHASH=8E2CE2D88C1F92045630EE37F4676E54{8223a6b9-1314-6902-0800-000000002b00}688C:\Windows\System32\wininit.exewininit.exeNT AUTHORITY\SYSTEM 13241300x80000000000000008718Microsoft-Windows-Sysmon/Operationalsoc101win11T1101SetValue2025-10-29 13:13:57.015{8223a6b9-1314-6902-0c00-000000002b00}856C:\WINDOWS\system32\lsass.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDefaultDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x80000000000000008719Microsoft-Windows-Sysmon/Operationalsoc101win11T1101SetValue2025-10-29 13:13:57.238{8223a6b9-1314-6902-0c00-000000002b00}856C:\WINDOWS\system32\lsass.exeHKLM\System\CurrentControlSet\Control\Lsa\ProductTypeDWORD (0x000000a2)NT AUTHORITY\SYSTEM 154100x80000000000000008720Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:57.288{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008721Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:57.399{8223a6b9-1315-6902-1000-000000002b00}700C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k RPCSS -pC:\WINDOWS\system32\NT AUTHORITY\NETWORK SERVICE{8223a6b9-1315-6902-e403-000000000000}0x3e40SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008722Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:57.442{8223a6b9-1315-6902-1100-000000002b00}804C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSMC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008723Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:57.591{8223a6b9-1315-6902-1200-000000002b00}1056C:\Windows\System32\LogonUI.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Logon User Interface HostMicrosoft® Windows® Operating SystemMicrosoft Corporationlogonui.exe"LogonUI.exe" /flags:0x2 /state0:0xa3bcf055 /state1:0x41c64e6dC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e71SystemMD5=CA1EDE2B18C459F9A1D9BB39225F4E50,SHA256=85326EFC9428DA086F425C311304268AE039DD0A0CC547DA01E3AA213318F950,IMPHASH=A725A6C0F65392C3C24A8AF649AC1C54{8223a6b9-1314-6902-0a00-000000002b00}760C:\Windows\System32\winlogon.exewinlogon.exeNT AUTHORITY\SYSTEM 154100x80000000000000008724Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:57.593{8223a6b9-1315-6902-1300-000000002b00}1064C:\Windows\System32\dwm.exe10.0.26100.3624 (WinBuild.160101.0800)Desktop Window ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationdwm.exe"dwm.exe"C:\WINDOWS\system32\Window Manager\DWM-1{8223a6b9-1315-6902-fa55-010000000000}0x155fa1SystemMD5=A8C31CECEDE4347F35120AE1514045ED,SHA256=1F7DD1CE8234473852AC6BC0061F9E554B56D5E6F096BAE33A2893114B9799B1,IMPHASH=D72871D9A3F2F20778DCEAAE6D7C89EF{8223a6b9-1314-6902-0a00-000000002b00}760C:\Windows\System32\winlogon.exewinlogon.exeNT AUTHORITY\SYSTEM 154100x80000000000000008725Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.110{8223a6b9-1316-6902-1400-000000002b00}1252C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k GPSvcGroupC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008726Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.117{8223a6b9-1316-6902-1700-000000002b00}1280C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s PrintDeviceConfigurationServiceC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008727Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.126{8223a6b9-1316-6902-1800-000000002b00}1324C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork -pC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008728Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.126{8223a6b9-1316-6902-1900-000000002b00}1316C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhostsC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008729Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.147{8223a6b9-1316-6902-1b00-000000002b00}1444C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvcC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008730Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.188{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008731Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.188{8223a6b9-1316-6902-1d00-000000002b00}1596C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s AppIDSvcC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008732Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.215{8223a6b9-1316-6902-1e00-000000002b00}1640C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k UserProfileService -p -s ProfSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008733Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.233{8223a6b9-1316-6902-1f00-000000002b00}1672C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalService -p -s nsiC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008734Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.278{8223a6b9-1316-6902-2000-000000002b00}1748C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netprofm -p -s netprofmC:\WINDOWS\system32\NT AUTHORITY\NETWORK SERVICE{8223a6b9-1315-6902-e403-000000000000}0x3e40SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008735Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.294{8223a6b9-1316-6902-2100-000000002b00}1768C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UserManagerC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008736Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.298{8223a6b9-1316-6902-2200-000000002b00}1776C:\Windows\System32\upfc.exe10.0.26100.4768 (WinBuild.160101.0800)Updateability From SCMMicrosoft® Windows® Operating SystemMicrosoft Corporationupfc.exeC:\WINDOWS\System32\Upfc.exe /launchtype boot /cv 0l+IcNzackCMFMeBlAbxDA.0C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=D08C489CEFBB9583AF988686E1A0C768,SHA256=06C1B9AF663E7EB7E284BEDC92C4A0A511CCA952DCC0D36C6344F7DB41B4FACF,IMPHASH=679AE244AE760F56F3F50641797A3915{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 11241100x80000000000000008737Microsoft-Windows-Sysmon/Operationalsoc101win11T10532025-10-29 13:13:58.309{8223a6b9-1316-6902-1c00-000000002b00}1588C:\WINDOWS\system32\svchost.exeC:\Windows\Tasks\SA.DAT2024-11-11 18:43:44.554NT AUTHORITY\SYSTEM 154100x80000000000000008738Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.342{8223a6b9-1316-6902-2300-000000002b00}1832C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvcC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008739Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.445{8223a6b9-1316-6902-2400-000000002b00}2000C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s UmRdpServiceC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008740Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.459{8223a6b9-1316-6902-2600-000000002b00}2016C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLogC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008741Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.481{8223a6b9-1316-6902-2700-000000002b00}1048C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe ExploitGuardPolicyC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008742Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.493{8223a6b9-1316-6902-2800-000000002b00}1380C:\Windows\System32\cmd.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\WINDOWS\SYSTEM32\cmd.exe /c ""C:\Program Files\Npcap\CheckStatus.bat""C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=90242B3940D153095204CCA04B83DCF3,SHA256=55D95D29D54112FC203D8B2D6335031FD0EF26C56C9459F239760C24DADD3F24,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008743Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.504{8223a6b9-1316-6902-2900-000000002b00}1396C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMainC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008744Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.519{8223a6b9-1316-6902-2a00-000000002b00}1636C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s ThemesC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008745Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.521{8223a6b9-1316-6902-2b00-000000002b00}1900C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalService -p -s EventSystemC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008746Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.535{8223a6b9-1316-6902-2c00-000000002b00}2076C:\Windows\System32\dxgiadaptercache.exe10.0.26100.3624 (WinBuild.160101.0800)DXGI Adapter CacheMicrosoft® Windows® Operating SystemMicrosoft CorporationDXGIAdapterCache.exe"C:\WINDOWS\system32\dxgiadaptercache.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=FFE4EF2EAE85C9D317027E7C6C6FAE30,SHA256=82AB1C8BA6D2AC0D51DAEF246A35CA54AD49F52CC7B9241FC7CBA1832D5B3936,IMPHASH=618B67EACA04EA41C7FD785E4ACC7038{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008747Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.620{8223a6b9-1316-6902-2e00-000000002b00}2332C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s SENSC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008748Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.662{8223a6b9-1316-6902-3100-000000002b00}2428C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalService -p -s FontCacheC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008749Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.667{8223a6b9-1316-6902-3200-000000002b00}2440C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilderC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008750Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.735{8223a6b9-1316-6902-3300-000000002b00}2528C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k NetworkService -p -s LanmanWorkstationC:\WINDOWS\system32\NT AUTHORITY\NETWORK SERVICE{8223a6b9-1315-6902-e403-000000000000}0x3e40SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 824800x80000000000000008751Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.742{8223a6b9-1315-6902-1300-000000002b00}1064C:\Windows\System32\dwm.exe{8223a6b9-1314-6902-0900-000000002b00}696C:\Windows\System32\csrss.exe25640xFFFFF8007E847EC0--Window Manager\DWM-1NT AUTHORITY\SYSTEM 154100x80000000000000008752Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.773{8223a6b9-1316-6902-3400-000000002b00}2624C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s DhcpC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008753Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.809{8223a6b9-1316-6902-3500-000000002b00}2684C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe TimeSyncTaskC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008754Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.820{8223a6b9-1316-6902-3600-000000002b00}2708C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k NetSvcs -p -s hnsC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008755Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.820{8223a6b9-1316-6902-3700-000000002b00}2716C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -pC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008756Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:58.922{8223a6b9-1316-6902-3900-000000002b00}2800C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementServiceC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008757Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.018{8223a6b9-1317-6902-3a00-000000002b00}2880C:\Windows\System32\ctfmon.exe10.0.26100.3624 (WinBuild.160101.0800)CTF LoaderMicrosoft® Windows® Operating SystemMicrosoft CorporationCTFMON.EXE/QuitInfo:0000000000000204;0000000000000214; C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e71SystemMD5=A3E50EF69038B3415A4D75820255A301,SHA256=F219F0975E70935D0BD4898BC568B146603C1D2E07ECE027F5E5B5E4EAD203D5,IMPHASH=B539389D4BE1DD68C8213A539FEB41FB{8223a6b9-1316-6902-3900-000000002b00}2800C:\Windows\System32\svchost.exeC:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementServiceNT AUTHORITY\SYSTEM 154100x80000000000000008758Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.067{8223a6b9-1317-6902-3b00-000000002b00}2960C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalServiceHttp -pC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008759Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.078{8223a6b9-1317-6902-3d00-000000002b00}2988C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetworkFirewall -pC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008760Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.108{8223a6b9-1317-6902-4000-000000002b00}3036C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvcC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008761Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.283{8223a6b9-1317-6902-4100-000000002b00}3184C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k appmodel -p -s StateRepositoryC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008762Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.311{8223a6b9-1317-6902-4200-000000002b00}3216C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WcmsvcC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008763Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.357{8223a6b9-1317-6902-4400-000000002b00}3276C:\Windows\System32\ClipRenew.exe10.0.26100.4768 (WinBuild.160101.0800)Acquire License From StoreMicrosoft® Windows® Operating SystemMicrosoft CorporationClipRenew.exe"C:\WINDOWS\system32\ClipRenew.exe" -eC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=0FD07469B0D4FEEBE99176CCF3C4BDC7,SHA256=649AD53A732DA7A0473040406E94F95D4029DDBA7FD67A7B5A392E3AFB69516D,IMPHASH=99CD5E069927805E37A630FEB314F1E2{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008764Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.377{8223a6b9-1317-6902-4500-000000002b00}3304C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s ShellHWDetectionC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 12241200x80000000000000008765Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteValue2025-10-29 13:13:59.435{8223a6b9-1315-6902-1200-000000002b00}1056C:\WINDOWS\system32\LogonUI.exeHKU\.DEFAULT\Keyboard Layout\Preload\1NT AUTHORITY\SYSTEM 13241300x80000000000000008766Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:13:59.435{8223a6b9-1315-6902-1200-000000002b00}1056C:\WINDOWS\system32\LogonUI.exeHKU\.DEFAULT\Keyboard Layout\Preload\100000409NT AUTHORITY\SYSTEM 154100x80000000000000008767Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.481{8223a6b9-1317-6902-4600-000000002b00}3392C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvcC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008768Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.515{8223a6b9-1317-6902-4700-000000002b00}3432C:\Windows\System32\spoolsv.exe10.0.26100.4768 (WinBuild.160101.0800)Spooler SubSystem AppMicrosoft® Windows® Operating SystemMicrosoft Corporationspoolsv.exeC:\WINDOWS\System32\spoolsv.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=820B301C3C50F22874F85FFBF4F033F2,SHA256=AE213F5A732BAF8A3A7EB2D76B21961195E896D3276F35C709A0CADB29F0BC01,IMPHASH=339B36254A24BF11E6C24F733846C8AF{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008769Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.743{8223a6b9-1317-6902-4800-000000002b00}3556C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k NetSvcs -s nvagentC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008770Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.979{8223a6b9-1317-6902-4900-000000002b00}3740C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgentC:\WINDOWS\system32\NT AUTHORITY\NETWORK SERVICE{8223a6b9-1315-6902-e403-000000000000}0x3e40SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008771Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.984{8223a6b9-1317-6902-4a00-000000002b00}3748C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s IKEEXTC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008772Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:13:59.988{8223a6b9-1317-6902-4b00-000000002b00}3756C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k NetSvcs -p -s iphlpsvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008773Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.017{8223a6b9-1318-6902-4c00-000000002b00}3776C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s LanmanServerC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008774Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.038{8223a6b9-1318-6902-4d00-000000002b00}3816C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPSC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008775Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.050{8223a6b9-1318-6902-4f00-000000002b00}3852C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -pC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008776Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.045{8223a6b9-1318-6902-4e00-000000002b00}3832C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k utcsvc -pC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008777Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.132{8223a6b9-1318-6902-5100-000000002b00}3972C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s SharedAccessC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008778Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.153{8223a6b9-1318-6902-5200-000000002b00}4036C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s WinmgmtC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008779Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.159{8223a6b9-1318-6902-5400-000000002b00}4056C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWksC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008780Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.179{8223a6b9-1318-6902-5500-000000002b00}4080C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe12.4.5.5473VMware Guest Authentication ServiceVMware Guest AuthenticationVMware, Inc.VGAuthService.exe"C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=D3DBE3C3DC56CB77005CB43ECD46F5C9,SHA256=B0145210B236EE2F001D5A9B14A70541740E8F6154108B1BDCF9478702AB020C,IMPHASH=EDFC41C63462FA352B6B3CB320C8AC70{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008781Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.186{8223a6b9-1318-6902-5600-000000002b00}3076C:\Program Files\VMware\VMware Tools\vmtoolsd.exe12.4.5.49651VMware Tools Core ServiceVMware ToolsVMware, Inc.vmtoolsd.exe"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=F7E079744B7AD6CD6F791898A1619460,SHA256=FA89670DF7E350D173A8B233D7F00BDBCF86F75041F76FB55EF29C2B996C0B43,IMPHASH=8A2930EA5F1EC61A2F9994C5214D2650{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008782Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.186{8223a6b9-1318-6902-5700-000000002b00}3300C:\Windows\System32\vm3dservice.exe9.17.07.0004VMware SVGA Helper ServiceVMware SVGA 3DVMware, Inc.vm3dservice.exeC:\WINDOWS\system32\vm3dservice.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=2172F4365DCFF8E8F2A2C2C77C391DB5,SHA256=41DCE909CC6E2A988727A62DE830CAFB7D0D9B404E2488459D5F8DA242E3341B,IMPHASH=A883606B194DAC36361014E31AC889A3{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008783Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.301{8223a6b9-1318-6902-5b00-000000002b00}4252C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s WpnServiceC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008784Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.272{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Antimalware Service ExecutableMicrosoft® Windows® Operating SystemMicrosoft CorporationMsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=77E9CCBB8335BA5D4345447BA5B6121D,SHA256=C02655606C199BA276D2B01A796E6EBBA07A41EEDE9C85FE516D9A5851290155,IMPHASH=6D2BBFBF0C29D2CD8E6FD86A0206A516{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008785Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.364{8223a6b9-1318-6902-5d00-000000002b00}4380C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k WSAIFabricSvcGroup -p -s WSAIFabricSvcC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008786Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.234{8223a6b9-1318-6902-5800-000000002b00}4136C:\Program Files (x86)\ossec-agent\wazuh-agent.exev4.6.0Wazuh AgentWazuh Windows AgentWazuh Inc.-"C:\Program Files (x86)\ossec-agent\wazuh-agent.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=48DB5DB47B10675EBA7DED6A0240CDCC,SHA256=80B80BAB77CEC09DF4FCC98F07915915D13B6ABBBDCC7666ECF8BAD47B9ADE67,IMPHASH=36DEAA9400DE44B83F70455512FAC6C9{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008787Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.492{8223a6b9-1318-6902-5f00-000000002b00}4528C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BrowserC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008788Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.533{8223a6b9-1318-6902-6000-000000002b00}4588C:\Windows\System32\vm3dservice.exe9.17.07.0004VMware SVGA Helper ServiceVMware SVGA 3DVMware, Inc.vm3dservice.exeC:\WINDOWS\system32\vm3dservice.exe -nC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e71SystemMD5=2172F4365DCFF8E8F2A2C2C77C391DB5,SHA256=41DCE909CC6E2A988727A62DE830CAFB7D0D9B404E2488459D5F8DA242E3341B,IMPHASH=A883606B194DAC36361014E31AC889A3{8223a6b9-1318-6902-5700-000000002b00}3300C:\Windows\System32\vm3dservice.exeC:\WINDOWS\system32\vm3dservice.exeNT AUTHORITY\SYSTEM 154100x80000000000000008789Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.071{8223a6b9-1318-6902-5000-000000002b00}3888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpDefenderCoreService.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Antimalware Core ServiceMicrosoft® Windows® Operating SystemMicrosoft CorporationMpDefenderCoreService.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpDefenderCoreService.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=FEB6562797D3B7A9E58AEEE0EF5387CF,SHA256=EA71D139107FE5ECFAFBB989E0962A46137DC52053874333BD1066F84BC7074C,IMPHASH=ED3A17AA05D0B4A9FB630A72E4C76D31{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008790Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.739{8223a6b9-1318-6902-6200-000000002b00}4788C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008791Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.439{8223a6b9-1318-6902-5e00-000000002b00}4468C:\Program Files\WSL\wslservice.exe2.3.26.0Windows Subsystem for Linux ServiceWindows Subsystem for LinuxMicrosoft Corporationwslservice.exe"C:\Program Files\WSL\wslservice.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6B3DC327642B1840BDFC1280A419CD43,SHA256=B63443A8DB7B3DB1B0439238A395DADF4D66B8C06A0A0457BD759D9D06946A25,IMPHASH=9DA2A9570932986B1B882C03C047A461{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008792Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.246{8223a6b9-1318-6902-5900-000000002b00}4164C:\Program Files (x86)\Wing FTP Server\WFTPServer.exe-----"C:\Program Files (x86)\Wing FTP Server\WFTPServer.exe" serviceC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A84C68060117CF18BAD1630208A925F,SHA256=0360AAE9EAEB70315514BA25FE39AB3A47C634B7CCEA024FD2723F2742E3C597,IMPHASH=A90C7A9D60DDCBB96A834877D8910A15{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 11241100x80000000000000008793Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.949{8223a6b9-1318-6902-5200-000000002b00}4036C:\WINDOWS\system32\svchost.exeC:\Windows\System32\wbem\Repository\WRITABLE.TST2025-10-29 13:14:00.949NT AUTHORITY\SYSTEM 154100x80000000000000008794Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.983{8223a6b9-1318-6902-6500-000000002b00}5028C:\Windows\System32\cmd.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\WINDOWS\system32\cmd.exe /c ""C:\Program Files\VMware\VMware Tools\poweron-vm-default.bat""C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=90242B3940D153095204CCA04B83DCF3,SHA256=55D95D29D54112FC203D8B2D6335031FD0EF26C56C9459F239760C24DADD3F24,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{8223a6b9-1318-6902-5600-000000002b00}3076C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"NT AUTHORITY\SYSTEM 154100x80000000000000008795Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.686{8223a6b9-1318-6902-6100-000000002b00}4732C:\Windows\Sysmon64.exe15.15System activity monitorSysinternals SysmonSysinternals - www.sysinternals.com-C:\WINDOWS\Sysmon64.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=7663C565BF28115506CB7EBD1DA389E0,SHA256=D9C8FDFDCE510FD9922DA3A1084B6AC4476C1407D1D8BBB67FC0A61988552771,IMPHASH=A039666F8D08DD16E0909469DA998438{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 13241300x80000000000000008796Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:01.122{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\MDCoreSvc\StartDWORD (0x00000002)NT AUTHORITY\SYSTEM 154100x80000000000000008797Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:01.341{8223a6b9-1319-6902-6800-000000002b00}5252C:\Windows\System32\wbem\unsecapp.exe10.0.26100.4202 (WinBuild.160101.0800)Sink to receive asynchronous callbacks for WMI client applicationMicrosoft® Windows® Operating SystemMicrosoft Corporationunsecapp.dllC:\WINDOWS\system32\wbem\unsecapp.exe -EmbeddingC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5584C351F1823053A4E66BB66282D923,SHA256=36FA30B1CFBC84F0F9E4F74428D4F6994B02E6C47113AE1F3BFE3A278962092E,IMPHASH=9656E21ED232DDC034DE628B1E2968AD{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x80000000000000008798Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:01.585{8223a6b9-1319-6902-6900-000000002b00}5420C:\Windows\System32\msdtc.exe2001.12.10941.16384 (WinBuild.160101.0800)Microsoft Distributed Transaction Coordinator ServiceMicrosoft® Windows® Operating SystemMicrosoft CorporationMSDTC.EXEC:\WINDOWS\System32\msdtc.exeC:\WINDOWS\system32\NT AUTHORITY\NETWORK SERVICE{8223a6b9-1315-6902-e403-000000000000}0x3e40SystemMD5=BB7C4EA1158C76361C64686A0E62650E,SHA256=C1866B5CB01FB83543929C61A1885DF137EB2317F87BBC346383D437413C09E7,IMPHASH=475D78C71E65532A4B0638519D521F5A{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008799Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:00.154{8223a6b9-1318-6902-5300-000000002b00}4048C:\Program Files\osquery\osqueryd\osqueryd.exe5.11.0.0osquery daemon and shellosqueryOsquery Foundationosqueryd.exe"C:\Program Files\osquery\osqueryd\osqueryd.exe" --flagfile=C:\Program Files\osquery\osquery.flagsC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=8FA3431CDD8590C04C7D9197231C4C50,SHA256=37271C5F0A95FE85056136A89DBAFD6D191D7ED7D43BB0842279C194886B8DB0,IMPHASH=CA548767B9890320F7B2B806ECEA2413{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 13241300x80000000000000008800Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:01.944{8223a6b9-1316-6902-2000-000000002b00}1748C:\WINDOWS\System32\svchost.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{F02987B0-5B23-45AB-A2CC-659724EB2D10}\DateLastConnectedBinary DataNT AUTHORITY\NETWORK SERVICE 154100x80000000000000008801Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:02.253{8223a6b9-131a-6902-6b00-000000002b00}5796C:\Windows\System32\cmd.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\WINDOWS\system32\cmd.exe /c reg query "HKLM\Software\WOW6432Node\Npcap" /ve 2>nul | find "REG_SZ"C:\Windows\System32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=90242B3940D153095204CCA04B83DCF3,SHA256=55D95D29D54112FC203D8B2D6335031FD0EF26C56C9459F239760C24DADD3F24,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{8223a6b9-1316-6902-2800-000000002b00}1380C:\Windows\System32\cmd.exeC:\WINDOWS\SYSTEM32\cmd.exe /c ""C:\Program Files\Npcap\CheckStatus.bat""NT AUTHORITY\SYSTEM 154100x80000000000000008802Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:02.270{8223a6b9-131a-6902-6c00-000000002b00}5812C:\Windows\System32\reg.exe10.0.26100.4484 (WinBuild.160101.0800)Registry Console ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationreg.exereg query "HKLM\Software\WOW6432Node\Npcap" /ve C:\Windows\System32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AB6C6B22FF2F2585DB01ECB18BFC0BE8,SHA256=5CEBCDCCD46D30D8B72D7790A81CC21B523D43680C11062FEB1E497524DAFBD1,IMPHASH=3B322244D4C64F3C932F94E6E3457771{8223a6b9-131a-6902-6b00-000000002b00}5796C:\Windows\System32\cmd.exeC:\WINDOWS\system32\cmd.exe /c reg query "HKLM\Software\WOW6432Node\Npcap" /ve 2>nul | find "REG_SZ"NT AUTHORITY\SYSTEM 154100x80000000000000008803Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:02.325{8223a6b9-131a-6902-6d00-000000002b00}5824C:\Windows\System32\find.exe10.0.26100.1 (WinBuild.160101.0800)Find String (grep) UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationFIND.EXEfind "REG_SZ"C:\Windows\System32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=21AF9D1389428FB7DE154C11ADCAC954,SHA256=CF9CC5A552DE280750B36743E80C33381E59D5EC8AA65A2DCFDD6A34198799BC,IMPHASH=7EF15CE1238ABC9D0468CB4D7C10B6F3{8223a6b9-131a-6902-6b00-000000002b00}5796C:\Windows\System32\cmd.exeC:\WINDOWS\system32\cmd.exe /c reg query "HKLM\Software\WOW6432Node\Npcap" /ve 2>nul | find "REG_SZ"NT AUTHORITY\SYSTEM 154100x80000000000000008804Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:02.401{8223a6b9-131a-6902-6e00-000000002b00}5844C:\Windows\System32\cmd.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\WINDOWS\system32\cmd.exe /c sc.exe qc npcapC:\Windows\System32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=90242B3940D153095204CCA04B83DCF3,SHA256=55D95D29D54112FC203D8B2D6335031FD0EF26C56C9459F239760C24DADD3F24,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{8223a6b9-1316-6902-2800-000000002b00}1380C:\Windows\System32\cmd.exeC:\WINDOWS\SYSTEM32\cmd.exe /c ""C:\Program Files\Npcap\CheckStatus.bat""NT AUTHORITY\SYSTEM 154100x80000000000000008805Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:02.425{8223a6b9-131a-6902-6f00-000000002b00}5856C:\Windows\System32\sc.exe10.0.26100.4484 (WinBuild.160101.0800)Service Control Manager Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsc.exesc.exe qc npcapC:\Windows\System32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=C8F632A326219F85927B3F33A13F7C7D,SHA256=A452BFCB6000D03942DDFADDCDA5A7EB121447ED99B1BA090446B4A989F1F7AE,IMPHASH=42DADBD60BBC453DD1773FDC089E19B7{8223a6b9-131a-6902-6e00-000000002b00}5844C:\Windows\System32\cmd.exeC:\WINDOWS\system32\cmd.exe /c sc.exe qc npcapNT AUTHORITY\SYSTEM 22542200x80000000000000008806Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:01.879{8223a6b9-1316-6902-3000-000000002b00}2340soc101win111460-C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICE 22542200x80000000000000008807Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:01.943{8223a6b9-1316-6902-2000-000000002b00}1748_ldap._tcp.dc._msdcs.localdomain123-C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICE 154100x80000000000000008808Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:02.847{8223a6b9-131a-6902-7100-000000002b00}5908C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe networkC:\WINDOWS\system32\NT AUTHORITY\NETWORK SERVICE{8223a6b9-1315-6902-e403-000000000000}0x3e40SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008809Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:03.017{8223a6b9-131b-6902-7200-000000002b00}5968C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k osprivacy -p -s camsvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008810Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:03.442{8223a6b9-131b-6902-7700-000000002b00}5852C:\Windows\System32\AggregatorHost.exe10.0.26100.4768 (WinBuild.160101.0800)Microsoft (R) Aggregator HostMicrosoft® Windows® Operating SystemMicrosoft CorporationAggregatorHost.exeAggregatorHost.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4076B2C887CA819BF687325EF7A089C7,SHA256=695A463DFEA05B8BFC4F5D193103456149313234C49E0D3FF7AED0931DD5B6A9,IMPHASH=AD82AF6FE8395BBD9698613C6EE80CD8{8223a6b9-1318-6902-4e00-000000002b00}3832C:\Windows\System32\svchost.exeC:\WINDOWS\System32\svchost.exe -k utcsvc -pNT AUTHORITY\SYSTEM 154100x80000000000000008811Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:03.488{8223a6b9-131b-6902-7800-000000002b00}1380C:\Windows\System32\slui.exe10.0.26100.4484 (WinBuild.160101.0800)Windows Activation ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationslui.exe"C:\WINDOWS\System32\SLUI.exe" RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=89e87510-ba92-45f6-8329-3afa905e3e83;NotificationInterval=1440;Trigger=TimerEventC:\WINDOWS\system32\NT AUTHORITY\NETWORK SERVICE{8223a6b9-1315-6902-e403-000000000000}0x3e40SystemMD5=3756CD9F4CD2D1DC9E4EA562743E2B56,SHA256=DF6434A5EB94353F23EB301C94C07DA828346A57F7402986B428839D3E5F1E29,IMPHASH=965E6FDBF2B84C0CDAA6303EA677DF71{8223a6b9-131b-6902-7600-000000002b00}5800C:\Windows\System32\SppExtComObj.ExeC:\WINDOWS\system32\SppExtComObj.exe -EmbeddingNT AUTHORITY\NETWORK SERVICE 154100x80000000000000008812Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:03.559{8223a6b9-131b-6902-7900-000000002b00}3208C:\Windows\System32\slui.exe10.0.26100.4484 (WinBuild.160101.0800)Windows Activation ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationslui.exe"C:\WINDOWS\System32\SLUI.exe" RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=89e87510-ba92-45f6-8329-3afa905e3e83;NotificationInterval=1440;Trigger=NetworkAvailableC:\WINDOWS\system32\NT AUTHORITY\NETWORK SERVICE{8223a6b9-1315-6902-e403-000000000000}0x3e40SystemMD5=3756CD9F4CD2D1DC9E4EA562743E2B56,SHA256=DF6434A5EB94353F23EB301C94C07DA828346A57F7402986B428839D3E5F1E29,IMPHASH=965E6FDBF2B84C0CDAA6303EA677DF71{8223a6b9-131b-6902-7600-000000002b00}5800C:\Windows\System32\SppExtComObj.ExeC:\WINDOWS\system32\SppExtComObj.exe -EmbeddingNT AUTHORITY\NETWORK SERVICE 154100x80000000000000008813Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:03.632{8223a6b9-131b-6902-7a00-000000002b00}1172C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalService -p -s LicenseManagerC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008814Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:04.143{8223a6b9-131c-6902-7c00-000000002b00}5732C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Antimalware-AMFilter.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x80000000000000008815Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:04.260{8223a6b9-131c-6902-7e00-000000002b00}5648C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Antimalware-AMFilter.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Drivers\WdFilter.sys" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Drivers\WdFilter.sys" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Drivers\WdFilter.sys"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x80000000000000008816Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:04.347{8223a6b9-131c-6902-8000-000000002b00}3208C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Windows-Windows Defender.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x80000000000000008817Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:14:04.417{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unsecapp.exe|c11d412e85f8935b\LowerCaseLongPathc:\windows\system32\wbem\unsecapp.exeNT AUTHORITY\SYSTEM 13241300x80000000000000008818Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:14:04.417{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unsecapp.exe|c11d412e85f8935b\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000008819Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:14:04.417{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unsecapp.exe|c11d412e85f8935b\LinkDate07/09/2077 02:14:19NT AUTHORITY\SYSTEM 13241300x80000000000000008820Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:14:04.417{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unsecapp.exe|c11d412e85f8935b\BinProductVersion10.0.26100.4202NT AUTHORITY\SYSTEM 12241200x80000000000000008821Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:14:04.425{8223a6b9-131c-6902-8000-000000002b00}3208C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/OperationalNT AUTHORITY\SYSTEM 12241200x80000000000000008822Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:14:04.457{8223a6b9-131c-6902-8000-000000002b00}3208C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHCNT AUTHORITY\SYSTEM 154100x80000000000000008823Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:04.471{8223a6b9-131c-6902-8200-000000002b00}6156C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Windows-Windows Defender.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpEvMsg.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpEvMsg.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpEvMsg.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x80000000000000008824Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\OwningPublisher{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}NT AUTHORITY\SYSTEM 13241300x80000000000000008825Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\EnabledDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x80000000000000008826Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\IsolationDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x80000000000000008827Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\ChannelAccessO:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)NT AUTHORITY\SYSTEM 13241300x80000000000000008828Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\MaxSizeDWORD (0x01000000)NT AUTHORITY\SYSTEM 13241300x80000000000000008829Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\MaxSizeUpperDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x80000000000000008830Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\TypeDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x80000000000000008831Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\OwningPublisher{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}NT AUTHORITY\SYSTEM 13241300x80000000000000008832Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\EnabledDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x80000000000000008833Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\IsolationDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x80000000000000008834Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ChannelAccessO:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)NT AUTHORITY\SYSTEM 13241300x80000000000000008835Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSizeDWORD (0x00040000)NT AUTHORITY\SYSTEM 13241300x80000000000000008836Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSizeUpperDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x80000000000000008837Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:04.560{8223a6b9-131c-6902-8200-000000002b00}6156C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\TypeDWORD (0x00000001)NT AUTHORITY\SYSTEM 154100x80000000000000008838Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:04.800{8223a6b9-131c-6902-8400-000000002b00}6292C:\Windows\System32\VSSVC.exe10.0.26100.3323 (WinBuild.160101.0800)Microsoft® Volume Shadow Copy ServiceMicrosoft® Windows® Operating SystemMicrosoft CorporationVSSVC.EXEC:\WINDOWS\system32\vssvc.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=3559C1EDC443935C920C259275FEC4B6,SHA256=6FB3F8164246636719919B53EC34522B1A332F4D0CFFCE30C88DC2CC596C9979,IMPHASH=632AC2019A2FB34FA7F16C068866AB50{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008839Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:04.873{8223a6b9-131c-6902-8500-000000002b00}6336C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Antimalware-Service.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x80000000000000008840Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:04.940{8223a6b9-131c-6902-8700-000000002b00}6392C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Antimalware-Service.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpSvc.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpSvc.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpSvc.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x80000000000000008841Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:05.020{8223a6b9-131d-6902-8900-000000002b00}6444C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Antimalware-NIS.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x80000000000000008842Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:05.027{8223a6b9-131d-6902-8b00-000000002b00}6460C:\Windows\UUS\amd64\WaaSMedicAgent.exe10.0.26100.4768 (WinBuild.160101.0800)WaasMedic Agent ExeMicrosoft® Windows® Operating SystemMicrosoft CorporationWaasMedicAgent.exeC:\WINDOWS\uus\AMD64\WaaSMedicAgent.exe 90f09f510d3637158bb965733db163ce 0l+IcNzackCMFMeBlAbxDA.0.1.0.3.0C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=7FFF526FC565C6A2EB8D6A21BFF901AA,SHA256=D262348FD1005297779B7A87DC8B4FC441A1FD19C59BED189FD6480AF5548ECF,IMPHASH=A640481B7998DC1021869FA45A890AA6{8223a6b9-1316-6902-2500-000000002b00}2008C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvcNT AUTHORITY\SYSTEM 154100x80000000000000008843Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:05.087{8223a6b9-131d-6902-8d00-000000002b00}6548C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Antimalware-NIS.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\NisSrv.exe" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\NisSrv.exe" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\NisSrv.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x80000000000000008844Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:05.156{8223a6b9-131d-6902-8f00-000000002b00}6600C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Antimalware-RTP.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x80000000000000008845Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:05.233{8223a6b9-131d-6902-9100-000000002b00}6652C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Antimalware-RTP.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpRtp.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpRtp.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpRtp.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x80000000000000008846Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:05.300{8223a6b9-131d-6902-9300-000000002b00}6704C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Antimalware-Protection.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x80000000000000008847Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:05.407{8223a6b9-131d-6902-9500-000000002b00}6756C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\Microsoft-Antimalware-Protection.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpClient.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpClient.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpClient.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x80000000000000008848Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:14:05.499{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeHKCR\CLSID\{2DCD7FDB-8809-48E4-8E4F-3157C57CF987}\InprocServer32\(Default)C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MPUXAGENT.DLLNT AUTHORITY\SYSTEM 13241300x80000000000000008849Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:14:05.499{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeHKCR\CLSID\{4DB116D1-9B24-4DFC-946B-BFE03E852002}\InProcServer32\(Default)C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MPUXAGENT.DLLNT AUTHORITY\SYSTEM 13241300x80000000000000008850Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:05.499{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\MDCoreSvc\StartDWORD (0x00000002)NT AUTHORITY\SYSTEM 13241300x80000000000000008851Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:05.516{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeHKCR\*\shellex\ContextMenuHandlers\EPP\(Default){09A47860-11B0-4DA5-AFA5-26D86198A780}NT AUTHORITY\SYSTEM 13241300x80000000000000008852Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:05.516{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeHKCR\Drive\shellex\ContextMenuHandlers\EPP\(Default){09A47860-11B0-4DA5-AFA5-26D86198A780}NT AUTHORITY\SYSTEM 13241300x80000000000000008853Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:05.516{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeHKCR\Directory\shellex\ContextMenuHandlers\EPP\(Default){09A47860-11B0-4DA5-AFA5-26D86198A780}NT AUTHORITY\SYSTEM 22542200x80000000000000008854Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:07.343{8223a6b9-1317-6902-3b00-000000002b00}2960wpad1460-C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICE 154100x80000000000000008855Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:08.158{8223a6b9-1320-6902-9700-000000002b00}6948C:\Windows\System32\wermgr.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Problem ReportingMicrosoft® Windows® Operating SystemMicrosoft CorporationWerMgr"C:\WINDOWS\system32\wermgr.exe" -uploadC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=ABE1D752643419A8252520AABF75C29D,SHA256=1707CB793B8F64B65CA5C2FEEB05CB7198349354E9E67ADE0671EEC3647F351B,IMPHASH=2FEAC3143808B4542A16622000CCFCAE{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 22542200x80000000000000008856Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:07.958{8223a6b9-1316-6902-2000-000000002b00}1748www.msftconnecttest.com0type: 5 ncsi-geo.trafficmanager.net;type: 5 www.msftncsi.com.edgesuite.net;type: 5 a1961.g2.akamai.net;::ffff:23.50.120.199;::ffff:23.50.120.198;C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICE 154100x80000000000000008857Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:09.116{8223a6b9-1321-6902-9800-000000002b00}7052C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivilegesC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4B730D779E8FFFAAD3320C097BE2B067,SHA256=A4291C5B4325895D13D32E232BF50C1B41356306803AC5DC75BBA9AECB021141,IMPHASH=E0220E5B585FC612AF76A6608C817F84{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x80000000000000008858Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:09.174{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WdNisDrv\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 154100x80000000000000008859Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:09.207{8223a6b9-1321-6902-9a00-000000002b00}7144C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdateC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4B730D779E8FFFAAD3320C097BE2B067,SHA256=A4291C5B4325895D13D32E232BF50C1B41356306803AC5DC75BBA9AECB021141,IMPHASH=E0220E5B585FC612AF76A6608C817F84{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x80000000000000008860Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:09.230{8223a6b9-1321-6902-9c00-000000002b00}6200C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\NisSrv.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Network Realtime Inspection ServiceMicrosoft® Windows® Operating SystemMicrosoft CorporationNisSrv.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\NisSrv.exe"C:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=CA9FAA940A4CEFCC81E7A234910C13B0,SHA256=9D70405BAC6B0DE403C34973606F1934DB979C809F18E42E5E89A368022CB778,IMPHASH=1DF092BD9A196CF019F35F9F3FEC51E5{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 22542200x80000000000000008861Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:09.992{8223a6b9-1316-6902-2700-000000002b00}1048vmw-keyid-45520bb2d7ecfcc02cc3173a41f71357b65fc1d1.microsoftaik.azure.net0type: 5 prdf.aadg.msidentity.com;type: 5 www.tm.f.prd.aadg.akadns.net;::ffff:40.126.29.23;::ffff:40.126.29.22;::ffff:40.126.29.2;::ffff:40.126.29.21;::ffff:40.126.29.20;::ffff:40.126.29.1;::ffff:40.126.29.0;C:\Windows\System32\taskhostw.exeNT AUTHORITY\SYSTEM 13241300x80000000000000008862Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:14.603{8223a6b9-1315-6902-1200-000000002b00}1056C:\WINDOWS\system32\LogonUI.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnUser.\AdministratorNT AUTHORITY\SYSTEM 154100x80000000000000008863Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:14.612{8223a6b9-1326-6902-9e00-000000002b00}6588C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvcC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008864Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:14.870{8223a6b9-1326-6902-9f00-000000002b00}6696C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k CameraMonitorC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 13241300x80000000000000008865Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.107{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\AarSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008866Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.107{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\AarSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k AarSvcGroup -pNT AUTHORITY\SYSTEM 154100x80000000000000008867Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.107{8223a6b9-1327-6902-a000-000000002b00}6748C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 13241300x80000000000000008868Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.111{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\BcastDVRUserService_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008869Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.111{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\BcastDVRUserService_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k BcastDVRUserServiceNT AUTHORITY\SYSTEM 13241300x80000000000000008870Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.113{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\BluetoothUserService_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008871Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.113{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\BluetoothUserService_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k BthAppGroup -pNT AUTHORITY\SYSTEM 13241300x80000000000000008872Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.119{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\CaptureService_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008873Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.119{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\CaptureService_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k LocalService -pNT AUTHORITY\SYSTEM 154100x80000000000000008874Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.116{8223a6b9-1327-6902-a100-000000002b00}6708C:\Windows\System32\sihost.exe10.0.26100.1882 (WinBuild.160101.0800)Shell Infrastructure HostMicrosoft® Windows® Operating SystemMicrosoft Corporationsihost.exesihost.exeC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=1CD5D3342251D0C39ADA51E3C0BB0BE2,SHA256=DE14D56A139FD4D02D4586728B7978B67C865013271916FA1E4DABA2918B1FBE,IMPHASH=0C2E5D141ACA7FB7E39618995321C151{8223a6b9-1316-6902-2100-000000002b00}1768C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UserManagerNT AUTHORITY\SYSTEM 13241300x80000000000000008875Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.121{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\cbdhsvc_ba422\StartDWORD (0x00000002)NT AUTHORITY\SYSTEM 13241300x80000000000000008876Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.121{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\cbdhsvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k ClipboardSvcGroup -pNT AUTHORITY\SYSTEM 13241300x80000000000000008877Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.123{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\CDPUserSvc_ba422\StartDWORD (0x00000002)NT AUTHORITY\SYSTEM 13241300x80000000000000008878Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.123{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\CDPUserSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k UnistackSvcGroupNT AUTHORITY\SYSTEM 13241300x80000000000000008879Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.127{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\CloudBackupRestoreSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008880Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.127{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\CloudBackupRestoreSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k UnistackSvcGroupNT AUTHORITY\SYSTEM 13241300x80000000000000008881Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.129{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\ConsentUxUserSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008882Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.129{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\ConsentUxUserSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k DevicesFlowNT AUTHORITY\SYSTEM 13241300x80000000000000008883Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.131{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\CredentialEnrollmentManagerUserSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008884Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.131{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\CredentialEnrollmentManagerUserSvc_ba422\ImagePathC:\WINDOWS\system32\CredentialEnrollmentManager.exeNT AUTHORITY\SYSTEM 13241300x80000000000000008885Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.133{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\DeviceAssociationBrokerSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008886Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.133{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\DeviceAssociationBrokerSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k DevicesFlow -pNT AUTHORITY\SYSTEM 13241300x80000000000000008887Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.135{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\DevicePickerUserSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008888Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.135{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\DevicePickerUserSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k DevicesFlowNT AUTHORITY\SYSTEM 13241300x80000000000000008889Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.137{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\DevicesFlowUserSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008890Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.137{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\DevicesFlowUserSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k DevicesFlowNT AUTHORITY\SYSTEM 13241300x80000000000000008891Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.141{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\MessagingService_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008892Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.141{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\MessagingService_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k UnistackSvcGroupNT AUTHORITY\SYSTEM 13241300x80000000000000008893Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.145{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\NPSMSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008894Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.145{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\NPSMSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k LocalService -pNT AUTHORITY\SYSTEM 13241300x80000000000000008895Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.147{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\OneSyncSvc_ba422\StartDWORD (0x00000002)NT AUTHORITY\SYSTEM 13241300x80000000000000008896Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.147{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\OneSyncSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k UnistackSvcGroupNT AUTHORITY\SYSTEM 13241300x80000000000000008897Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.149{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\P9RdrService_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008898Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.149{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\P9RdrService_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k P9RdrService -pNT AUTHORITY\SYSTEM 13241300x80000000000000008899Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.151{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\PenService_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008900Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.151{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\PenService_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k PenServiceNT AUTHORITY\SYSTEM 13241300x80000000000000008901Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.155{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008902Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.155{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k UnistackSvcGroupNT AUTHORITY\SYSTEM 13241300x80000000000000008903Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.157{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\PrintWorkflowUserSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008904Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.157{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\PrintWorkflowUserSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k PrintWorkflowNT AUTHORITY\SYSTEM 13241300x80000000000000008905Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.161{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\UdkUserSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008906Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.161{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\UdkUserSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k UdkSvcGroupNT AUTHORITY\SYSTEM 13241300x80000000000000008907Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.161{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\UnistoreSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008908Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.161{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\UnistoreSvc_ba422\ImagePathC:\WINDOWS\System32\svchost.exe -k UnistackSvcGroupNT AUTHORITY\SYSTEM 13241300x80000000000000008909Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.163{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\UserDataSvc_ba422\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x80000000000000008910Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.163{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\UserDataSvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k UnistackSvcGroupNT AUTHORITY\SYSTEM 13241300x80000000000000008911Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.165{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\webthreatdefusersvc_ba422\StartDWORD (0x00000002)NT AUTHORITY\SYSTEM 13241300x80000000000000008912Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.165{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\webthreatdefusersvc_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -pNT AUTHORITY\SYSTEM 13241300x80000000000000008913Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.167{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WpnUserService_ba422\StartDWORD (0x00000002)NT AUTHORITY\SYSTEM 13241300x80000000000000008914Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:14:15.167{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WpnUserService_ba422\ImagePathC:\WINDOWS\system32\svchost.exe -k UnistackSvcGroupNT AUTHORITY\SYSTEM 154100x80000000000000008915Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.171{8223a6b9-1327-6902-a200-000000002b00}6800C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationServiceC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008916Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.176{8223a6b9-1327-6902-a300-000000002b00}6760C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvcC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008917Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.199{8223a6b9-1327-6902-a400-000000002b00}6528C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvcC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008918Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.236{8223a6b9-1327-6902-a500-000000002b00}6460C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s WpnUserServiceC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008919Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.298{8223a6b9-1327-6902-a600-000000002b00}7024C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008920Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.303{8223a6b9-1327-6902-a700-000000002b00}7036C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s TokenBrokerC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008921Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.311{8223a6b9-1327-6902-a800-000000002b00}7004C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008922Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.321{8223a6b9-1327-6902-a900-000000002b00}7008C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008923Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.332{8223a6b9-1327-6902-aa00-000000002b00}7072C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /cC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008924Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.545{8223a6b9-1327-6902-ab00-000000002b00}6692C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalService -p -s CDPSvcC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008925Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.695{8223a6b9-1327-6902-ac00-000000002b00}7256C:\Windows\System32\slui.exe10.0.26100.4484 (WinBuild.160101.0800)Windows Activation ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationslui.exe"C:\WINDOWS\System32\SLUI.exe" RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=89e87510-ba92-45f6-8329-3afa905e3e83;NotificationInterval=1440;Trigger=UserLogon;SessionId=1C:\WINDOWS\system32\NT AUTHORITY\NETWORK SERVICE{8223a6b9-1315-6902-e403-000000000000}0x3e40SystemMD5=3756CD9F4CD2D1DC9E4EA562743E2B56,SHA256=DF6434A5EB94353F23EB301C94C07DA828346A57F7402986B428839D3E5F1E29,IMPHASH=965E6FDBF2B84C0CDAA6303EA677DF71{8223a6b9-131b-6902-7600-000000002b00}5800C:\Windows\System32\SppExtComObj.ExeC:\WINDOWS\system32\SppExtComObj.exe -EmbeddingNT AUTHORITY\NETWORK SERVICE 154100x80000000000000008926Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.751{8223a6b9-1327-6902-ad00-000000002b00}7304C:\Windows\System32\slui.exe10.0.26100.4484 (WinBuild.160101.0800)Windows Activation ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationslui.exeC:\WINDOWS\System32\slui.exe -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=3756CD9F4CD2D1DC9E4EA562743E2B56,SHA256=DF6434A5EB94353F23EB301C94C07DA828346A57F7402986B428839D3E5F1E29,IMPHASH=965E6FDBF2B84C0CDAA6303EA677DF71{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x80000000000000008927Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.782{8223a6b9-1327-6902-ae00-000000002b00}7328C:\Windows\System32\userinit.exe10.0.26100.4484 (WinBuild.160101.0800)Userinit Logon ApplicationMicrosoft® Windows® Operating SystemMicrosoft CorporationUSERINIT.EXEC:\WINDOWS\system32\userinit.exeC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=08A5A039278FB14C1F872BBE55D8C5BB,SHA256=64CCAF40EE788F63738C811A2E9B8FF66C777D820BA9008E6C568954EBDC1C4F,IMPHASH=831F09A183825FCD04B27DF4080A7582{8223a6b9-1314-6902-0a00-000000002b00}760C:\Windows\System32\winlogon.exewinlogon.exeNT AUTHORITY\SYSTEM 154100x80000000000000008928Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.835{8223a6b9-1327-6902-af00-000000002b00}7368C:\Windows\explorer.exe10.0.26100.4768 (WinBuild.160101.0800)Windows ExplorerMicrosoft® Windows® Operating SystemMicrosoft CorporationEXPLORER.EXEC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=5E6C926A8C43C90472417CBA00E96820,SHA256=EF7BC1AEBE53658E8B92F51E1693671F2220E1CAE7D5DD92DEC977DA6C82CAFC,IMPHASH=9ADB846E02C3BD5CC3A7DBC3FD2DCA34{8223a6b9-1327-6902-ae00-000000002b00}7328C:\Windows\System32\userinit.exeC:\WINDOWS\system32\userinit.exesoc101win11\Administrator 154100x80000000000000008929Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:15.902{8223a6b9-1327-6902-b000-000000002b00}7400C:\Windows\System32\ShellHost.exe10.0.26100.4768 (WinBuild.160101.0800)ShellHostMicrosoft® Windows® Operating SystemMicrosoft CorporationShellHost.exe"C:\Windows\System32\ShellHost.exe"C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=25CD2D40C80C3492310864D9ECA46849,SHA256=1695122C6F4160CAC0BF2CDD20DBAB38A2AEDC29BBC18BFC36AA07B229FFFCC4,IMPHASH=5D86A36429F669912036DD1BEBCE55D4{8223a6b9-1327-6902-a100-000000002b00}6708C:\Windows\System32\sihost.exesihost.exesoc101win11\Administrator 154100x80000000000000008930Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:16.280{8223a6b9-1328-6902-b200-000000002b00}7620C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResume.exe2125.17600.0.0-Microsoft® Windows® Operating SystemMicrosoft CorporationCrossDeviceResume.exe"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResume.exe" /tileid MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeAppC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=D75916490080BC96DEEC62DF8976BEB7,SHA256=4B25EA727B4905B88C0941FF22091BDA83DF137428494321B986671EABCDC675,IMPHASH=C4CD5015B55B46336513DE7F281A9B04{8223a6b9-1327-6902-a100-000000002b00}6708C:\Windows\System32\sihost.exesihost.exesoc101win11\Administrator 154100x80000000000000008931Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:16.573{8223a6b9-1328-6902-b300-000000002b00}7696C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvcC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 22542200x80000000000000008932Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:16.716{8223a6b9-1317-6902-4700-000000002b00}3432SOC101WIN110fe80::a832:a53b:32c1:6645;::ffff:172.16.143.133;C:\Windows\System32\spoolsv.exeNT AUTHORITY\SYSTEM 154100x80000000000000008933Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:17.838{8223a6b9-1329-6902-b900-000000002b00}7492C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvcC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008934Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:18.085{8223a6b9-132a-6902-bc00-000000002b00}8252C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.22301.90.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe525.22301.40.0-Microsoft® Windows® Operating SystemMicrosoft CorporationWidgets.exe"C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.22301.90.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServerC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=81A4B9534F4640B2A01148A08879E1C9,SHA256=7311758CF6C730E20CD38090E21DB9BF61DA6A5E187F77C4C2E6E35A73BC5AEA,IMPHASH=18F4C68545C5D3070BF221F0E6B4F08D{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 22542200x80000000000000008935Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:17.938{8223a6b9-1317-6902-4700-000000002b00}3432SOC101WIN110172.16.143.133;C:\Windows\System32\spoolsv.exeNT AUTHORITY\SYSTEM 22542200x80000000000000008936Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:17.938{8223a6b9-1317-6902-4700-000000002b00}3432SOC101WIN110fe80::a832:a53b:32c1:6645;C:\Windows\System32\spoolsv.exeNT AUTHORITY\SYSTEM 154100x80000000000000008937Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:18.921{8223a6b9-132a-6902-be00-000000002b00}8640C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource coreC:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.199.11\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1327-6902-aa00-000000002b00}7072C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /cNT AUTHORITY\SYSTEM 154100x80000000000000008938Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:19.223{8223a6b9-132b-6902-c100-000000002b00}8792C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe0.5.0.0WidgetService.exeWidgets Platform RuntimeMicrosoft CorporationWidgetService.exe"C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=7E8BB0805D97016C3D0121836FE7E21A,SHA256=7335EEC0530B4FB2B8E523A16AE7D4D4F3FEA3D98E00F5B608EF204EB73F6578,IMPHASH=91719B95729577E550F597CC4FD3F981{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x80000000000000008939Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:23.523{8223a6b9-132f-6902-ca00-000000002b00}9988C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s lfsvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008940Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:24.112{8223a6b9-1330-6902-cb00-000000002b00}10148C:\Windows\System32\smartscreen.exe10.0.26100.4652 (WinBuild.160101.0800)Windows Defender SmartScreenMicrosoft® Windows® Operating SystemMicrosoft Corporationsmartscreen.exeC:\Windows\System32\smartscreen.exe -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=4B9FD8FEFBA636B66F81E0CDBD12B3DA,SHA256=86530447A3E2B502FE2AC164434B13137E5505A86743A96A091EC18A9377D9D9,IMPHASH=C84171DF6E7F087EA4E625CCCE2AB167{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x80000000000000008941Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:27.242{8223a6b9-1333-6902-cd00-000000002b00}9720C:\Windows\System32\oobe\UserOOBEBroker.exe10.0.26100.3624 (WinBuild.160101.0800)User OOBE BrokerMicrosoft® Windows® Operating SystemMicrosoft CorporationUserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CDFEA7CDEC9B4FACB7A6360B1320A945,SHA256=CBF49D6F6C72058CFA35FE3E7E5BD9ACCC58A3B77CC9FCE9635599B598C3B057,IMPHASH=1E87A888E7E2FDA75A690AB7D6818D68{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x80000000000000008942Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:27.349{8223a6b9-1333-6902-ce00-000000002b00}7976C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileCoAuth.exe25.159.0817.0003Microsoft OneDriveFile Co-Authoring ExecutableMicrosoft OneDriveMicrosoft CorporationFileCoAuth.exe"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileCoAuth.exe" -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=DA15ECEE1CDDA36B23C86C85019F3B07,SHA256=37503E4234147A3F873586F63CFD9EDEF9A5024D4C98D9AB710AB07D54733B1A,IMPHASH=407C742688E30E9C56211721840A108A{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x80000000000000008943Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:27.685{8223a6b9-1333-6902-cf00-000000002b00}9124C:\Windows\System32\ctfmon.exe10.0.26100.3624 (WinBuild.160101.0800)CTF LoaderMicrosoft® Windows® Operating SystemMicrosoft CorporationCTFMON.EXE/QuitInfo:0000000000000274;0000000000000278; C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=A3E50EF69038B3415A4D75820255A301,SHA256=F219F0975E70935D0BD4898BC568B146603C1D2E07ECE027F5E5B5E4EAD203D5,IMPHASH=B539389D4BE1DD68C8213A539FEB41FB{8223a6b9-1316-6902-3900-000000002b00}2800C:\Windows\System32\svchost.exeC:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementServiceNT AUTHORITY\SYSTEM 154100x80000000000000008944Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:28.702{8223a6b9-1334-6902-d100-000000002b00}10280C:\Windows\System32\SIHClient.exe1350.2506.29012.0SIH ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationsihclient.exeC:\WINDOWS\System32\sihclient.exe /cv 0l+IcNzackCMFMeBlAbxDA.0.2C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=31219950056F3AD089EE3DC8E2EAE083,SHA256=C98F0E7F21B1CB371DB84ED4FB9692171C3EAB38BB400754633B7536AE360B14,IMPHASH=837499ADAB542A83642C23324CBE2E60{8223a6b9-1316-6902-2200-000000002b00}1776C:\Windows\System32\upfc.exeC:\WINDOWS\System32\Upfc.exe /launchtype boot /cv 0l+IcNzackCMFMeBlAbxDA.0NT AUTHORITY\SYSTEM 22542200x80000000000000008945Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:28.038{8223a6b9-132c-6902-c400-000000002b00}9148wpad1460-C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exesoc101win11\Administrator 154100x80000000000000008946Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:29.431{8223a6b9-1335-6902-d200-000000002b00}10332C:\Windows\System32\AppHostRegistrationVerifier.exe10.0.26100.4202 (WinBuild.160101.0800)App Uri Handlers Registration VerifierMicrosoft® Windows® Operating SystemMicrosoft CorporationAppHostNameRegistrationVerifier.exe"C:\WINDOWS\system32\AppHostRegistrationVerifier.exe"C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=52A337ECD6667A11692E82DC77545028,SHA256=2C7EBBEE4AAA4E60D7444800E1F3A9797E10D2EF01A65382C4116C9BD4CB409A,IMPHASH=6C914AB773FBD8191DFBD4E4439F189B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008947Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:29.441{8223a6b9-1335-6902-d300-000000002b00}10348C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" -IdleTask -TaskName WdVerificationC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4B730D779E8FFFAAD3320C097BE2B067,SHA256=A4291C5B4325895D13D32E232BF50C1B41356306803AC5DC75BBA9AECB021141,IMPHASH=E0220E5B585FC612AF76A6608C817F84{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008948Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:29.448{8223a6b9-1335-6902-d400-000000002b00}10364C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" -IdleTask -TaskName WdCleanupC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4B730D779E8FFFAAD3320C097BE2B067,SHA256=A4291C5B4325895D13D32E232BF50C1B41356306803AC5DC75BBA9AECB021141,IMPHASH=E0220E5B585FC612AF76A6608C817F84{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008949Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:29.716{8223a6b9-1335-6902-d700-000000002b00}10524C:\Windows\System32\SecurityHealthService.exe10.0.26100.3624 (WinBuild.160101.0800)Windows Security Health ServiceMicrosoft® Windows® Operating SystemMicrosoft CorporationSecurityHealthService.exeC:\WINDOWS\system32\SecurityHealthService.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=79DBF0DF097DD309F3B8FE62D9612B46,SHA256=D33874DA2E3E7E0CEFB6B369DC9FFCB7B77B4B74FFFB8E15EE18D4DBA23D0E13,IMPHASH=04BA4BDBA20FA3CE99778FD77096B5FA{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 13241300x80000000000000008950Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:14:29.824{8223a6b9-1335-6902-d700-000000002b00}10524C:\WINDOWS\system32\SecurityHealthService.exeHKCR\WdMam\Shell\Open\Command\(Default)C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe %%1NT AUTHORITY\SYSTEM 154100x80000000000000008951Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:29.900{8223a6b9-1335-6902-d800-000000002b00}10588C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe10.0.27840.1000 (WinBuild.160101.0800)Windows Security Health HostMicrosoft® Windows® Operating SystemMicrosoft CorporationSecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=478FBFDA6A51CF9F0D5BFD50B72DFB08,SHA256=272896B88C6C30DD41E8D44FD54A676FDC6A675BE3F38AAA7434F51B98B822E0,IMPHASH=E8960CAF12CF621B3CA78988264C27F1{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 13241300x80000000000000008952Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:14:29.999{8223a6b9-1329-6902-b800-000000002b00}4048C:\Windows\System32\RuntimeBroker.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} {2FABA4C7-4DA9-4013-9697-20CC3FD40F85} 0xFFFFBinary Datasoc101win11\Administrator 13241300x80000000000000008953Microsoft-Windows-Sysmon/Operationalsoc101win11Suspicious,ImageBeginWithBackslashSetValue2025-10-29 13:14:30.003{8223a6b9-1335-6902-d800-000000002b00}10588\\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\418A073AA3BC1C75Binary Datasoc101win11\Administrator 13241300x80000000000000008954Microsoft-Windows-Sysmon/Operationalsoc101win11Suspicious,ImageBeginWithBackslashSetValue2025-10-29 13:14:30.007{8223a6b9-1335-6902-d800-000000002b00}10588\\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\418A073AA3BC1C75Binary Datasoc101win11\Administrator 13241300x80000000000000008955Microsoft-Windows-Sysmon/Operationalsoc101win11Suspicious,ImageBeginWithBackslashSetValue2025-10-29 13:14:30.007{8223a6b9-1335-6902-d800-000000002b00}10588\\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\418A073AA3BC1C75Binary Datasoc101win11\Administrator 13241300x80000000000000008956Microsoft-Windows-Sysmon/Operationalsoc101win11Suspicious,ImageBeginWithBackslashSetValue2025-10-29 13:14:30.007{8223a6b9-1335-6902-d800-000000002b00}10588\\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\418A073AA3BC1C75Binary Datasoc101win11\Administrator 11241100x80000000000000008957Microsoft-Windows-Sysmon/Operationalsoc101win11T10532025-10-29 13:14:30.011{8223a6b9-1316-6902-1c00-000000002b00}1588C:\WINDOWS\system32\svchost.exeC:\Windows\System32\Tasks\PostponeDeviceSetupToast_S-1-5-21-4051859043-1187413090-3677023548-500_02025-10-29 13:14:30.011NT AUTHORITY\SYSTEM 13241300x80000000000000008958Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:14:30.146{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\apphostregistrat|23d050ec54a320fe\LowerCaseLongPathc:\windows\system32\apphostregistrationverifier.exeNT AUTHORITY\SYSTEM 13241300x80000000000000008959Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:14:30.146{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\apphostregistrat|23d050ec54a320fe\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000008960Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:14:30.146{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\apphostregistrat|23d050ec54a320fe\LinkDate08/18/2030 16:54:50NT AUTHORITY\SYSTEM 13241300x80000000000000008961Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:14:30.146{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\apphostregistrat|23d050ec54a320fe\BinProductVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x80000000000000008962Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:14:30.751{8223a6b9-1327-6902-af00-000000002b00}7368C:\WINDOWS\Explorer.EXEHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Control Panel\NotifyIconSettings\14088594186581486386\PublisherMicrosoft Windowssoc101win11\Administrator 22542200x80000000000000008963Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:31.201{8223a6b9-1335-6902-d200-000000002b00}10332to-do.office.com0type: 5 outlook.office365.com;type: 5 ooc-g2.tm-4.office.com;::ffff:52.96.165.50;::ffff:52.96.37.34;::ffff:52.96.172.114;::ffff:52.96.173.146;::ffff:52.96.165.226;::ffff:52.96.104.34;::ffff:52.96.104.50;::ffff:52.96.173.210;C:\Windows\System32\AppHostRegistrationVerifier.exesoc101win11\Administrator 22542200x80000000000000008964Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:32.062{8223a6b9-1335-6902-d200-000000002b00}10332staging.to-do.officeppe.com9003-C:\Windows\System32\AppHostRegistrationVerifier.exesoc101win11\Administrator 534500x80000000000000008965Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:33.618{8223a6b9-1333-6902-ce00-000000002b00}7976C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileCoAuth.exesoc101win11\Administrator 154100x80000000000000008966Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:42.568{8223a6b9-1342-6902-e200-000000002b00}11056C:\Windows\System32\DataExchangeHost.exe10.0.26100.4202 (WinBuild.160101.0800)Data Exchange HostMicrosoft® Windows® Operating SystemMicrosoft CorporationDataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=971ED9E3801DD3B9F639C823E46009A7,SHA256=ADBD854FEFB12B1AAA7AE2AB2DDEC5F59A7C2E9AB037BE7CC239205B4AEBFE71,IMPHASH=13C2794134C5CD3964484311DEA46EA7{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x80000000000000008967Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:45.803{8223a6b9-1345-6902-e300-000000002b00}11120C:\Windows\System32\wlrmdr.exe10.0.26100.3624 (WinBuild.160101.0800)Windows logon reminderMicrosoft® Windows® Operating SystemMicrosoft CorporationWLRMNDR.EXE -c -s 0 -f 0 -t Empty -m Empty -a 0 -u EmptyC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=E2229DC1B19D2C589617E12B1481B9C1,SHA256=18FF283B94A44C281A1418019969AB7B5C689D4823985834BBFFDE282BFC200D,IMPHASH=0CE1167F022650E5C6F6A3764CF80084{8223a6b9-1314-6902-0a00-000000002b00}760C:\Windows\System32\winlogon.exewinlogon.exeNT AUTHORITY\SYSTEM 154100x80000000000000008968Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:45.807{8223a6b9-1345-6902-e400-000000002b00}4604C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe SyncFromCloudC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008969Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:46.653{8223a6b9-1346-6902-eb00-000000002b00}1124C:\Windows\System32\backgroundTaskHost.exe10.0.26100.1 (WinBuild.160101.0800)Background Task HostMicrosoft® Windows® Operating SystemMicrosoft CorporationbackgroundTaskHost.exe"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:WindowsBackup.AppXnn6fnh4raxtmg45ba8k2f4ykb7n0k3y4.mcaC:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=8BDE0AE40012BD639FC60E494CC32356,SHA256=B7D2C17E0038945AA4B72AE7A89E54D29B04CCC0FEB62DF5C9B7B67DE43C2530,IMPHASH=DC601E2593053A84A6989DE251407AA7{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 13241300x80000000000000008970Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:14:46.917{8223a6b9-1327-6902-af00-000000002b00}7368C:\WINDOWS\Explorer.EXEHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}\shell\SpotlightClick\command\DelegateExecute{4813071a-41ad-44a2-9835-886d2f63ca30}soc101win11\Administrator 154100x80000000000000008971Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:47.155{8223a6b9-1347-6902-ee00-000000002b00}10576C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileCoAuth.exe25.159.0817.0003Microsoft OneDriveFile Co-Authoring ExecutableMicrosoft OneDriveMicrosoft CorporationFileCoAuth.exe"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileCoAuth.exe" -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=DA15ECEE1CDDA36B23C86C85019F3B07,SHA256=37503E4234147A3F873586F63CFD9EDEF9A5024D4C98D9AB710AB07D54733B1A,IMPHASH=407C742688E30E9C56211721840A108A{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x80000000000000008972Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:47.169{8223a6b9-1347-6902-ef00-000000002b00}10856C:\Windows\System32\BdeUISrv.exe10.0.26100.2894 (WinBuild.160101.0800)BDE UI LauncherMicrosoft® Windows® Operating SystemMicrosoft CorporationBDEUISRV.DLLC:\WINDOWS\System32\BdeUISrv.exe -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=4CE6BDC4F92C31EEDB088E74698100D6,SHA256=A25C2B0F1D111856573F06FFEEAA9D02C1D96769C0BB375D0EAC65F557557EEE,IMPHASH=26FC02AE7E783017EE0998C22957BDD0{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 534500x80000000000000008973Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:53.605{8223a6b9-1347-6902-ee00-000000002b00}10576C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileCoAuth.exesoc101win11\Administrator 154100x80000000000000008974Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:14:59.042{8223a6b9-1353-6902-f000-000000002b00}7452C:\Windows\System32\dxgiadaptercache.exe10.0.26100.3624 (WinBuild.160101.0800)DXGI Adapter CacheMicrosoft® Windows® Operating SystemMicrosoft CorporationDXGIAdapterCache.exe"C:\WINDOWS\system32\dxgiadaptercache.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=FFE4EF2EAE85C9D317027E7C6C6FAE30,SHA256=82AB1C8BA6D2AC0D51DAEF246A35CA54AD49F52CC7B9241FC7CBA1832D5B3936,IMPHASH=618B67EACA04EA41C7FD785E4ACC7038{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000008975Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:00.201{8223a6b9-1354-6902-f100-000000002b00}6712C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe10.0.27840.1000 (WinBuild.160101.0800)Windows Security Health HostMicrosoft® Windows® Operating SystemMicrosoft CorporationSecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=478FBFDA6A51CF9F0D5BFD50B72DFB08,SHA256=272896B88C6C30DD41E8D44FD54A676FDC6A675BE3F38AAA7434F51B98B822E0,IMPHASH=E8960CAF12CF621B3CA78988264C27F1{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x80000000000000008976Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:00.893{8223a6b9-1354-6902-f200-000000002b00}5732C:\Windows\System32\SecurityHealthSystray.exe10.0.26100.1882 (WinBuild.160101.0800)Windows Security notification iconMicrosoft® Windows® Operating SystemMicrosoft CorporationSecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe" C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=04DB94F10266A28B3A7B6FD0D1C75969,SHA256=7E1747256C74F48D153B7F95A53151CA6988BB210CFEC60EB05921F5DA94FC0E,IMPHASH=81064125BBA480CDFE4B334998446BE8{8223a6b9-1327-6902-af00-000000002b00}7368C:\Windows\explorer.exeC:\WINDOWS\Explorer.EXEsoc101win11\Administrator 154100x80000000000000008977Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:02.479{8223a6b9-1356-6902-f300-000000002b00}5720C:\Program Files\VMware\VMware Tools\vmtoolsd.exe12.4.5.49651VMware Tools Core ServiceVMware ToolsVMware, Inc.vmtoolsd.exe"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=F7E079744B7AD6CD6F791898A1619460,SHA256=FA89670DF7E350D173A8B233D7F00BDBCF86F75041F76FB55EF29C2B996C0B43,IMPHASH=8A2930EA5F1EC61A2F9994C5214D2650{8223a6b9-1327-6902-af00-000000002b00}7368C:\Windows\explorer.exeC:\WINDOWS\Explorer.EXEsoc101win11\Administrator 154100x80000000000000008978Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:02.630{8223a6b9-1356-6902-f400-000000002b00}5692C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000008979Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:03.152{8223a6b9-1357-6902-f500-000000002b00}10828C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTkuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUFFNjYyMUItNTE5Ri00OTI3LThBODEtRDhBQUVBMkMyQjhCfSIgdXNlcmlkPSJ7QTJDNUU4Q0UtNzk1Qi00NDdGLThCRkYtOEJCNEYwNkFCNUI1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OUI4OTIwNUMtODdDMS00MTAyLTkzQTktQTdCM0JBQzQ5OThDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjQiIHBoeXNtZW1vcnk9IjIwIiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuNDk0NiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE2MiIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iVk13YXJlLCBJbmMuIiBwcm9kdWN0X25hbWU9IlZNd2FyZTIwLDEiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEzMS4wLjY3NzguNzAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9Ik9aWlkiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzNTEiIGluc3RhbGxkYXRldGltZT0iMTczMTM0MjMwNCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzc1ODE1MTY1ODE2OTgzNiIgZmlyc3RfZnJlX3NlZW5fdGltZT0iMTM0MDEzODM1NDI4NjQ5MzEwIiBmaXJzdF9mcmVfc2Vlbl92ZXJzaW9uPSIxMzkuMC4zNDA1LjEyNSI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxODAzNzQiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc2MDY5Mjc1MyIvPjwvYXBwPjwvcmVxdWVzdD4C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.199.11\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1356-6902-f400-000000002b00}5692C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcNT AUTHORITY\SYSTEM 154100x80000000000000008980Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:04.069{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe25.159.0817.0003Microsoft OneDriveMicrosoft OneDriveMicrosoft CorporationOneDrive.exe"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /backgroundC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=5AD05925A8FE3A1A15EB2449F70AA135,SHA256=0AD18EC348A99FD04EDD65477B48FB6D0B9535411AF0F5E9B40C0C61A57E91DD,IMPHASH=9B64999A42FEBC0CB20DB21F6621FC6F{8223a6b9-1327-6902-af00-000000002b00}7368C:\Windows\explorer.exeC:\WINDOWS\Explorer.EXEsoc101win11\Administrator 13241300x80000000000000008981Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000008982Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000008983Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000008984Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000008985Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000008986Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000008987Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000008988Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000008989Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000008990Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000008991Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000008992Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000008993Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000008994Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000008995Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000008996Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000008997Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000008998Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000008999Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009000Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009001Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009002Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009003Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009004Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009005Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009006Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009007Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009008Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009009Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009010Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009011Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009012Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009013Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009014Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:04.739{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009015Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.755{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\i386\FileCoAuthLib.dllsoc101win11\Administrator 13241300x80000000000000009016Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:04.760{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileCoAuthLib64.dllsoc101win11\Administrator 13241300x80000000000000009017Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:04.760{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\odopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009018Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:04.760{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\odopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009019Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:04.760{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009020Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:04.760{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 22542200x80000000000000009021Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:04.811{8223a6b9-1318-6902-5e00-000000002b00}4468api.github.com0::ffff:140.82.112.6;C:\Program Files\WSL\wslservice.exeNT AUTHORITY\SYSTEM 154100x80000000000000009022Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:05.299{8223a6b9-1359-6902-f700-000000002b00}728C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileCoAuth.exe25.159.0817.0003Microsoft OneDriveFile Co-Authoring ExecutableMicrosoft OneDriveMicrosoft CorporationFileCoAuth.exe"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileCoAuth.exe" -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=DA15ECEE1CDDA36B23C86C85019F3B07,SHA256=37503E4234147A3F873586F63CFD9EDEF9A5024D4C98D9AB710AB07D54733B1A,IMPHASH=407C742688E30E9C56211721840A108A{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 13241300x80000000000000009023Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:05.598{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009024Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:05.598{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 154100x80000000000000009025Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:06.331{8223a6b9-135a-6902-f900-000000002b00}10476C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2509.42011.0_x64__8wekyb3d8bbwe\m365copilot_autostarter.exe-----"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2509.42011.0_x64__8wekyb3d8bbwe\m365copilot_autostarter.exe" C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=FB6BF39F8D6670A2E9B14A403FB16348,SHA256=B1840B123E327F8E8324D43E3D96B3FC62E79A0314966A527E50C7696110D507,IMPHASH=11A5BA82ECB066D0C57FF5BF19D8CB80{8223a6b9-1327-6902-a100-000000002b00}6708C:\Windows\System32\sihost.exesihost.exesoc101win11\Administrator 154100x80000000000000009026Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:06.978{8223a6b9-135a-6902-fa00-000000002b00}9528C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2509.42011.0_x64__8wekyb3d8bbwe\WebViewHost.exe19.2509.42011.0Microsoft 365 Copilot AppMicrosoft 365 CopilotMicrosoft CorporationWebViewHost.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2509.42011.0_x64__8wekyb3d8bbwe\WebViewHost.exe" ms-getoffice: autostart reason=AutoStarterC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=4346F28935126BECAB53D1766C68A9A5,SHA256=DE81BE6CBE0EBA6B2186990521EC0D7135C0EB0832F3D012BA2086D262A87052,IMPHASH=1B40BEE88B12B6F993E8737951C7417A{8223a6b9-135a-6902-f900-000000002b00}10476C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2509.42011.0_x64__8wekyb3d8bbwe\m365copilot_autostarter.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2509.42011.0_x64__8wekyb3d8bbwe\m365copilot_autostarter.exe" soc101win11\Administrator 154100x80000000000000009027Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:07.679{8223a6b9-135b-6902-fc00-000000002b00}4728C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s seclogonC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009028Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:07.831{8223a6b9-135b-6902-fe00-000000002b00}5460C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe140.0.3485.66Microsoft Edge WebView2Microsoft Edge WebView2Microsoft Corporationmsedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=9528.4564.12231744914887873383 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=BE9BDE9E62C9312D4CBD457BCBCD7DBB,SHA256=3E69D3BDEEF96EF731F491A27EC5C79A17D038F626AB246801B89486E67A9C55,IMPHASH=9ACEBDFAC77931C2B0DFBBEA2D494BA9{8223a6b9-135a-6902-fa00-000000002b00}9528C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2509.42011.0_x64__8wekyb3d8bbwe\WebViewHost.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2509.42011.0_x64__8wekyb3d8bbwe\WebViewHost.exe" ms-getoffice: autostart reason=AutoStartersoc101win11\Administrator 154100x80000000000000009029Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:07.931{8223a6b9-135b-6902-ff00-000000002b00}3876C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe140.0.3485.66Microsoft Edge WebView2Microsoft Edge WebView2Microsoft Corporationmsedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView /prefetch:4 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0cc --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=140.0.7339.133 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=140.0.3485.66 --initial-client-data=0x19c,0x1a0,0x1a4,0x168,0x1a8,0x7ff8d5d82200,0x7ff8d5d8220c,0x7ff8d5d82218C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=BE9BDE9E62C9312D4CBD457BCBCD7DBB,SHA256=3E69D3BDEEF96EF731F491A27EC5C79A17D038F626AB246801B89486E67A9C55,IMPHASH=9ACEBDFAC77931C2B0DFBBEA2D494BA9{8223a6b9-135b-6902-fe00-000000002b00}5460C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=9528.4564.12231744914887873383 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccsoc101win11\Administrator 154100x80000000000000009030Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:08.155{8223a6b9-135c-6902-0001-000000002b00}3376C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe140.0.3485.66Microsoft Edge WebView2Microsoft Edge WebView2Microsoft Corporationmsedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1664,i,9441038020296075668,2370477150872858398,262144 --field-trial-handle=1824,i,16309926270948425934,13846169497689979656,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEnhancedTrackingPreventionEnabled,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:2 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccC:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1LowMD5=BE9BDE9E62C9312D4CBD457BCBCD7DBB,SHA256=3E69D3BDEEF96EF731F491A27EC5C79A17D038F626AB246801B89486E67A9C55,IMPHASH=9ACEBDFAC77931C2B0DFBBEA2D494BA9{8223a6b9-135b-6902-fe00-000000002b00}5460C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=9528.4564.12231744914887873383 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccsoc101win11\Administrator 154100x80000000000000009031Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:08.164{8223a6b9-135c-6902-0101-000000002b00}3492C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe140.0.3485.66Microsoft Edge WebView2Microsoft Edge WebView2Microsoft Corporationmsedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=1992,i,4808531080583271863,4240956299034664681,524288 --field-trial-handle=1824,i,16309926270948425934,13846169497689979656,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEnhancedTrackingPreventionEnabled,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccC:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=BE9BDE9E62C9312D4CBD457BCBCD7DBB,SHA256=3E69D3BDEEF96EF731F491A27EC5C79A17D038F626AB246801B89486E67A9C55,IMPHASH=9ACEBDFAC77931C2B0DFBBEA2D494BA9{8223a6b9-135b-6902-fe00-000000002b00}5460C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=9528.4564.12231744914887873383 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccsoc101win11\Administrator 154100x80000000000000009032Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:08.217{8223a6b9-135c-6902-0201-000000002b00}10584C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe140.0.3485.66Microsoft Edge WebView2Microsoft Edge WebView2Microsoft Corporationmsedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=2328,i,2092152241967741418,7674121917277633664,524288 --field-trial-handle=1824,i,16309926270948425934,13846169497689979656,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEnhancedTrackingPreventionEnabled,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccC:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1LowMD5=BE9BDE9E62C9312D4CBD457BCBCD7DBB,SHA256=3E69D3BDEEF96EF731F491A27EC5C79A17D038F626AB246801B89486E67A9C55,IMPHASH=9ACEBDFAC77931C2B0DFBBEA2D494BA9{8223a6b9-135b-6902-fe00-000000002b00}5460C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=9528.4564.12231744914887873383 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccsoc101win11\Administrator 22542200x80000000000000009033Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:07.284{8223a6b9-1358-6902-f600-000000002b00}10944ecs.office.com0type: 5 ecs.office.trafficmanager.net;type: 5 dual-s-0005-office.config.skype.com;type: 5 ecs-office.s-0005.dual-s-msedge.net;type: 5 s-0005.dual-s-msedge.net;::ffff:52.123.129.14;::ffff:52.123.128.14;C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administrator 22542200x80000000000000009034Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:07.540{8223a6b9-132e-6902-c800-000000002b00}9780oneclient.sfx.ms0type: 5 oneclient.sfx.ms.edgesuite.net;type: 5 a124.dscd.akamai.net;::ffff:23.219.155.161;::ffff:23.219.155.142;::ffff:23.219.155.165;::ffff:23.219.155.167;::ffff:23.219.155.173;::ffff:23.219.155.145;::ffff:23.219.155.150;::ffff:23.219.155.175;::ffff:23.219.155.190;C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEM 354300x80000000000000009035Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:07.301{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49763-false13.107.246.41-443https 354300x80000000000000009036Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:07.312{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49764-false52.123.129.14-443https 154100x80000000000000009037Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:08.352{8223a6b9-135c-6902-0301-000000002b00}11304C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe140.0.3485.66Microsoft Edge WebView2Microsoft Edge WebView2Microsoft Corporationmsedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--expose-gc --ms-user-locale=" --time-ticks-at-unix-epoch=-1761743627040776 --launch-time-ticks=81308103 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3552,i,759199376643787333,3766257765722339035,2097152 --field-trial-handle=1824,i,16309926270948425934,13846169497689979656,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEnhancedTrackingPreventionEnabled,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=3556 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0cc /prefetch:1C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1LowMD5=BE9BDE9E62C9312D4CBD457BCBCD7DBB,SHA256=3E69D3BDEEF96EF731F491A27EC5C79A17D038F626AB246801B89486E67A9C55,IMPHASH=9ACEBDFAC77931C2B0DFBBEA2D494BA9{8223a6b9-135b-6902-fe00-000000002b00}5460C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=9528.4564.12231744914887873383 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccsoc101win11\Administrator 13241300x80000000000000009038Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:08.518{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009039Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:08.518{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 354300x80000000000000009040Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:07.439{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49765-false162.159.142.9-80http 22542200x80000000000000009041Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:07.693{8223a6b9-1358-6902-f600-000000002b00}10944oneclient.sfx.ms0type: 5 oneclient.sfx.ms.edgesuite.net;type: 5 a124.dscd.akamai.net;::ffff:23.219.155.161;::ffff:23.219.155.142;::ffff:23.219.155.165;::ffff:23.219.155.167;::ffff:23.219.155.173;::ffff:23.219.155.145;::ffff:23.219.155.150;::ffff:23.219.155.175;::ffff:23.219.155.190;C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administrator 354300x80000000000000009042Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:07.796{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49768-false23.219.155.161a23-219-155-161.deploy.static.akamaitechnologies.com443https 154100x80000000000000009043Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:10.414{8223a6b9-135e-6902-0401-000000002b00}11568C:\Windows\SysWOW64\runonce.exe10.0.26100.4768 (WinBuild.160101.0800)Run Once WrapperMicrosoft® Windows® Operating SystemMicrosoft CorporationRUNONCE.EXEC:\WINDOWS\SysWOW64\runonce.exe /Run6432C:\WINDOWS\SysWOW64\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=39CD48EC90F64CEEBFAF6B4CADAA2262,SHA256=B186B24BA13C6AF6E7BE223619F8963C510B8186DBE4DA86A4A48BCC83761A81,IMPHASH=D1BB3974605EE6C09496D9A6FB3D049E{8223a6b9-1327-6902-af00-000000002b00}7368C:\Windows\explorer.exeC:\WINDOWS\Explorer.EXEsoc101win11\Administrator 154100x80000000000000009044Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:10.642{8223a6b9-135e-6902-0501-000000002b00}11608C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe2.8.431.10Java Update SchedulerJava Platform SE Auto UpdaterOracle Corporationjusched.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" C:\WINDOWS\SysWOW64\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=3C9463E5EEC8D543EF15D967C933D040,SHA256=0D139F5D4EDEA457AD830186D14076A3A7F5A375BB7DBBA763D23F710FA827A8,IMPHASH=5D2536415681E3CE77F7B79596BEAC0D{8223a6b9-135e-6902-0401-000000002b00}11568C:\Windows\SysWOW64\runonce.exeC:\WINDOWS\SysWOW64\runonce.exe /Run6432soc101win11\Administrator 154100x80000000000000009045Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:11.049{8223a6b9-135f-6902-0601-000000002b00}11632C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe-----"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe" C:\Users\Administrator\AppData\Local\Programs\Ollama\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=FBAECDD9C03F463D316119BD776501E8,SHA256=10EE87D9C889E41B4226D6C7902C014DA745291DD96FA37A6F0915A2A62EFDB2,IMPHASH=381F0D9D17ED9707D58FDC0AC52A26E7{8223a6b9-1327-6902-af00-000000002b00}7368C:\Windows\explorer.exeC:\WINDOWS\Explorer.EXEsoc101win11\Administrator 354300x80000000000000009046Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:09.712{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49771-false20.189.173.27-443https 534500x80000000000000009047Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:11.556{8223a6b9-1359-6902-f700-000000002b00}728C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\FileCoAuth.exesoc101win11\Administrator 154100x80000000000000009048Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:11.680{8223a6b9-135f-6902-0801-000000002b00}11760C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 22542200x80000000000000009049Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:11.248{8223a6b9-135f-6902-0601-000000002b00}11632ollama.com0::ffff:34.36.133.15;C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administrator 154100x80000000000000009050Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:12.202{8223a6b9-1360-6902-0901-000000002b00}11808C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama.exe-----C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama.exe serveC:\Users\Administrator\AppData\Local\Ollama\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=AE8E14CF44F2D7A12B97EF4E54C4FBEF,SHA256=CB34C3137927BAFB17342B4F79F90332804A8C9FFEAF7058E0B4B40737A6D3FC,IMPHASH=5DAC5D4CADE852AD7594BAB358401F19{8223a6b9-135f-6902-0601-000000002b00}11632C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe" soc101win11\Administrator 11241100x80000000000000009051Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:12.462{8223a6b9-1356-6902-f400-000000002b00}5692C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeC:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.205.9\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exe2025-10-29 13:15:12.460NT AUTHORITY\SYSTEM 354300x80000000000000009052Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:11.294{8223a6b9-135f-6902-0601-000000002b00}11632C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49785-false34.36.133.15-443https 13241300x80000000000000009053Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:15:13.234{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dataexchangehost|a7eea8ca9cc3eb5a\LowerCaseLongPathc:\windows\system32\dataexchangehost.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009054Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:15:13.234{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dataexchangehost|a7eea8ca9cc3eb5a\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009055Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:15:13.234{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dataexchangehost|a7eea8ca9cc3eb5a\LinkDate04/16/2065 18:45:08NT AUTHORITY\SYSTEM 13241300x80000000000000009056Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:15:13.234{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dataexchangehost|a7eea8ca9cc3eb5a\BinProductVersion10.0.26100.4202NT AUTHORITY\SYSTEM 154100x80000000000000009057Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:13.247{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exe1.3.205.9Microsoft Edge Update SetupMicrosoft Edge UpdateMicrosoft CorporationMicrosoftEdgeUpdateSetup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exe" /update /sessionid "{5AE6621B-519F-4927-8A81-D8AAEA2C2B8B}"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.199.11\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=2376CC33F4311F249615A3821C7790CD,SHA256=367FC3648EE66E9171B34CE96EB4F3A474A69442328BC95910FCC2BE37D47305,IMPHASH=7899CB8BA886A0690BDC28D8B481BBD1{8223a6b9-1356-6902-f400-000000002b00}5692C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcNT AUTHORITY\SYSTEM 154100x80000000000000009058Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:13.355{8223a6b9-1361-6902-0c01-000000002b00}11964C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTkuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUFFNjYyMUItNTE5Ri00OTI3LThBODEtRDhBQUVBMkMyQjhCfSIgdXNlcmlkPSJ7QTJDNUU4Q0UtNzk1Qi00NDdGLThCRkYtOEJCNEYwNkFCNUI1fSIgaW5zdGFsbHNvdXJjZT0iY29yZSIgcmVxdWVzdGlkPSJ7OTM2MDA5QTMtMDgyMS00NERGLTg1NzItOEY3Mjk4MkZEQzNFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjQiIHBoeXNtZW1vcnk9IjIwIiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuNDk0NiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE2MiIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iVk13YXJlLCBJbmMuIiBwcm9kdWN0X25hbWU9IlZNd2FyZTIwLDEiLz48ZXhwIGV0YWc9IiZxdW90O2hVcDV6L1RVM0NiMy9vcUR4NXNPaG9lSUFjemdlcVF0MnIvUzJHakVLaG89JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTkuMTEiIG5leHR2ZXJzaW9uPSIxLjMuMjA1LjkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzNTEiIGNvaG9ydD0icnJmQDAuNzYiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc4NzM2NTQ4NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3ODc0MjYyOTkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODU1MzA1NTgzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZWUwMGYxMTgtMTQ4Mi00NmMyLWJkOWYtMTBhMzZkZWI5YjgwP1AxPTE3NjIzNDg1MDYmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9aGpPdm1rZVVHUjNEOHptczdjbFF6VnZ1RFIlMmZUUmlNdTMyR1BKZnNQNEFTVGVyRkxIQ3loWm9EcVBOUHZlUGpoQzUzREgxQkNJeCUyYlcxSFcwODh2TUJBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTY4NzEzNiIgdG90YWw9IjE2ODcxMzYiIGRvd25sb2FkX3RpbWVfbXM9IjY2MzEiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODU1Mzc2Mzc4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg2MDYzNTUwMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9IjQxIiByZD0iNjgzNSIgcGluZ19mcmVzaG5lc3M9InsyNUIwOTdBRS1DMkU3LTRBOTQtQkNFQy0yQjRBMzc1OUQzMDZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0MC4wLjM0ODUuNjYiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMzUxIiBjb2hvcnQ9InJyZkAwLjMxIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNzU4MTM1NzczMjExMTcwIiB1cGRhdGVfY291bnQ9IjQiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzQwMjcwMTM4NTI0NDAzMTAiIGZpcnN0X2ZyZV9zZWVuX3RpbWU9IjEzNDAxMzgzNTQyODY0OTMxMCIgZmlyc3RfZnJlX3NlZW5fdmVyc2lvbj0iMTM5LjAuMzQwNS4xMjUiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSI0MSIgcj0iNDEiIGFkPSI2ODM1IiByZD0iNjgzNSIgcGluZ19mcmVzaG5lc3M9Ins0Q0YyNjU2Mi01NjY5LTQ4Q0QtOTlGOC04ODlCOUIzNEZDQkJ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjE0MC4wLjM0ODUuNjYiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMzUxIiBjb2hvcnQ9InJyZkAwLjU4IiB1cGRhdGVfY291bnQ9IjMiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzQwMjcwNjcyODI1NzM5ODAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSI0MSIgcj0iNDEiIGFkPSI2ODM1IiByZD0iNjgzNSIgcGluZ19mcmVzaG5lc3M9Ins2QTA5NkNCRC0wQjQxLTQ1MEYtQjc5Ny1ERTA0NEEyQjAzQzF9Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.199.11\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1356-6902-f400-000000002b00}5692C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcNT AUTHORITY\SYSTEM 11241100x80000000000000009059Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:13.594{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdate.exe2025-10-29 13:15:13.594NT AUTHORITY\SYSTEM 11241100x80000000000000009060Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.596{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdate.dll2025-10-29 13:15:13.596NT AUTHORITY\SYSTEM 11241100x80000000000000009061Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:13.602{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdateBroker.exe2025-10-29 13:15:13.602NT AUTHORITY\SYSTEM 11241100x80000000000000009062Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:13.604{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdateOnDemand.exe2025-10-29 13:15:13.604NT AUTHORITY\SYSTEM 11241100x80000000000000009063Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:13.604{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe2025-10-29 13:15:13.604NT AUTHORITY\SYSTEM 11241100x80000000000000009064Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:13.606{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeComRegisterShellARM64.exe2025-10-29 13:15:13.606NT AUTHORITY\SYSTEM 11241100x80000000000000009065Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.608{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\psmachine.dll2025-10-29 13:15:13.608NT AUTHORITY\SYSTEM 11241100x80000000000000009066Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.610{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\psmachine_64.dll2025-10-29 13:15:13.610NT AUTHORITY\SYSTEM 11241100x80000000000000009067Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.614{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\psmachine_arm64.dll2025-10-29 13:15:13.614NT AUTHORITY\SYSTEM 11241100x80000000000000009068Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.616{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\psuser.dll2025-10-29 13:15:13.616NT AUTHORITY\SYSTEM 11241100x80000000000000009069Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.618{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\psuser_64.dll2025-10-29 13:15:13.618NT AUTHORITY\SYSTEM 11241100x80000000000000009070Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.620{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\psuser_arm64.dll2025-10-29 13:15:13.620NT AUTHORITY\SYSTEM 11241100x80000000000000009071Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:13.624{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdateCore.exe2025-10-29 13:15:13.624NT AUTHORITY\SYSTEM 11241100x80000000000000009072Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.626{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_am.dll2025-10-29 13:15:13.626NT AUTHORITY\SYSTEM 11241100x80000000000000009073Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.628{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ar.dll2025-10-29 13:15:13.628NT AUTHORITY\SYSTEM 11241100x80000000000000009074Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.630{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_bg.dll2025-10-29 13:15:13.630NT AUTHORITY\SYSTEM 11241100x80000000000000009075Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.632{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_bn.dll2025-10-29 13:15:13.632NT AUTHORITY\SYSTEM 11241100x80000000000000009076Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.634{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ca.dll2025-10-29 13:15:13.634NT AUTHORITY\SYSTEM 11241100x80000000000000009077Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.636{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_cs.dll2025-10-29 13:15:13.636NT AUTHORITY\SYSTEM 11241100x80000000000000009078Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.638{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_da.dll2025-10-29 13:15:13.636NT AUTHORITY\SYSTEM 11241100x80000000000000009079Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.640{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_de.dll2025-10-29 13:15:13.638NT AUTHORITY\SYSTEM 11241100x80000000000000009080Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.640{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_el.dll2025-10-29 13:15:13.640NT AUTHORITY\SYSTEM 11241100x80000000000000009081Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.642{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_en.dll2025-10-29 13:15:13.642NT AUTHORITY\SYSTEM 11241100x80000000000000009082Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.644{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_en-GB.dll2025-10-29 13:15:13.644NT AUTHORITY\SYSTEM 11241100x80000000000000009083Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.646{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_es.dll2025-10-29 13:15:13.646NT AUTHORITY\SYSTEM 11241100x80000000000000009084Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.647{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_es-419.dll2025-10-29 13:15:13.647NT AUTHORITY\SYSTEM 11241100x80000000000000009085Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.651{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_et.dll2025-10-29 13:15:13.649NT AUTHORITY\SYSTEM 11241100x80000000000000009086Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.651{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_fa.dll2025-10-29 13:15:13.651NT AUTHORITY\SYSTEM 11241100x80000000000000009087Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.653{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_fi.dll2025-10-29 13:15:13.653NT AUTHORITY\SYSTEM 11241100x80000000000000009088Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.656{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_fil.dll2025-10-29 13:15:13.656NT AUTHORITY\SYSTEM 11241100x80000000000000009089Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.658{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_fr.dll2025-10-29 13:15:13.658NT AUTHORITY\SYSTEM 11241100x80000000000000009090Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.660{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_gu.dll2025-10-29 13:15:13.660NT AUTHORITY\SYSTEM 11241100x80000000000000009091Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.660{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_hi.dll2025-10-29 13:15:13.660NT AUTHORITY\SYSTEM 11241100x80000000000000009092Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.662{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_hr.dll2025-10-29 13:15:13.662NT AUTHORITY\SYSTEM 11241100x80000000000000009093Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.665{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_hu.dll2025-10-29 13:15:13.665NT AUTHORITY\SYSTEM 11241100x80000000000000009094Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.669{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_id.dll2025-10-29 13:15:13.667NT AUTHORITY\SYSTEM 11241100x80000000000000009095Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.671{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_is.dll2025-10-29 13:15:13.671NT AUTHORITY\SYSTEM 11241100x80000000000000009096Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.671{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_it.dll2025-10-29 13:15:13.671NT AUTHORITY\SYSTEM 11241100x80000000000000009097Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.673{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_iw.dll2025-10-29 13:15:13.673NT AUTHORITY\SYSTEM 11241100x80000000000000009098Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.675{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ja.dll2025-10-29 13:15:13.675NT AUTHORITY\SYSTEM 11241100x80000000000000009099Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.677{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_kn.dll2025-10-29 13:15:13.677NT AUTHORITY\SYSTEM 11241100x80000000000000009100Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.677{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ko.dll2025-10-29 13:15:13.677NT AUTHORITY\SYSTEM 11241100x80000000000000009101Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.681{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_lt.dll2025-10-29 13:15:13.679NT AUTHORITY\SYSTEM 11241100x80000000000000009102Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.681{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_lv.dll2025-10-29 13:15:13.681NT AUTHORITY\SYSTEM 11241100x80000000000000009103Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.683{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ml.dll2025-10-29 13:15:13.683NT AUTHORITY\SYSTEM 11241100x80000000000000009104Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.687{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_mr.dll2025-10-29 13:15:13.685NT AUTHORITY\SYSTEM 11241100x80000000000000009105Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.689{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ms.dll2025-10-29 13:15:13.689NT AUTHORITY\SYSTEM 11241100x80000000000000009106Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.691{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_nb.dll2025-10-29 13:15:13.691NT AUTHORITY\SYSTEM 11241100x80000000000000009107Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.694{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_nl.dll2025-10-29 13:15:13.694NT AUTHORITY\SYSTEM 11241100x80000000000000009108Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.695{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_pl.dll2025-10-29 13:15:13.695NT AUTHORITY\SYSTEM 11241100x80000000000000009109Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.697{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_pt-BR.dll2025-10-29 13:15:13.697NT AUTHORITY\SYSTEM 11241100x80000000000000009110Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.699{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_pt-PT.dll2025-10-29 13:15:13.699NT AUTHORITY\SYSTEM 11241100x80000000000000009111Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.701{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ro.dll2025-10-29 13:15:13.701NT AUTHORITY\SYSTEM 11241100x80000000000000009112Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.703{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ru.dll2025-10-29 13:15:13.703NT AUTHORITY\SYSTEM 11241100x80000000000000009113Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.705{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_sk.dll2025-10-29 13:15:13.705NT AUTHORITY\SYSTEM 11241100x80000000000000009114Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.708{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_sl.dll2025-10-29 13:15:13.708NT AUTHORITY\SYSTEM 11241100x80000000000000009115Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.711{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_sr.dll2025-10-29 13:15:13.710NT AUTHORITY\SYSTEM 11241100x80000000000000009116Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.713{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_sv.dll2025-10-29 13:15:13.711NT AUTHORITY\SYSTEM 11241100x80000000000000009117Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.715{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ta.dll2025-10-29 13:15:13.715NT AUTHORITY\SYSTEM 11241100x80000000000000009118Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.717{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_te.dll2025-10-29 13:15:13.717NT AUTHORITY\SYSTEM 11241100x80000000000000009119Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.719{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_th.dll2025-10-29 13:15:13.719NT AUTHORITY\SYSTEM 11241100x80000000000000009120Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.721{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_tr.dll2025-10-29 13:15:13.719NT AUTHORITY\SYSTEM 11241100x80000000000000009121Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.721{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_uk.dll2025-10-29 13:15:13.721NT AUTHORITY\SYSTEM 11241100x80000000000000009122Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.723{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ur.dll2025-10-29 13:15:13.723NT AUTHORITY\SYSTEM 11241100x80000000000000009123Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.725{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_vi.dll2025-10-29 13:15:13.725NT AUTHORITY\SYSTEM 11241100x80000000000000009124Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.727{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_zh-CN.dll2025-10-29 13:15:13.727NT AUTHORITY\SYSTEM 11241100x80000000000000009125Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.729{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_zh-TW.dll2025-10-29 13:15:13.729NT AUTHORITY\SYSTEM 11241100x80000000000000009126Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.731{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_af.dll2025-10-29 13:15:13.729NT AUTHORITY\SYSTEM 11241100x80000000000000009127Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.731{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_as.dll2025-10-29 13:15:13.731NT AUTHORITY\SYSTEM 11241100x80000000000000009128Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.733{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_az.dll2025-10-29 13:15:13.733NT AUTHORITY\SYSTEM 11241100x80000000000000009129Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.735{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_bn-IN.dll2025-10-29 13:15:13.735NT AUTHORITY\SYSTEM 11241100x80000000000000009130Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.737{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_bs.dll2025-10-29 13:15:13.735NT AUTHORITY\SYSTEM 11241100x80000000000000009131Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.737{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ca-Es-VALENCIA.dll2025-10-29 13:15:13.737NT AUTHORITY\SYSTEM 11241100x80000000000000009132Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.739{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_cy.dll2025-10-29 13:15:13.739NT AUTHORITY\SYSTEM 11241100x80000000000000009133Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.741{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_eu.dll2025-10-29 13:15:13.741NT AUTHORITY\SYSTEM 11241100x80000000000000009134Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.743{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_fr-CA.dll2025-10-29 13:15:13.743NT AUTHORITY\SYSTEM 11241100x80000000000000009135Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.745{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ga.dll2025-10-29 13:15:13.745NT AUTHORITY\SYSTEM 11241100x80000000000000009136Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.747{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_gd.dll2025-10-29 13:15:13.747NT AUTHORITY\SYSTEM 11241100x80000000000000009137Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.749{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_gl.dll2025-10-29 13:15:13.749NT AUTHORITY\SYSTEM 11241100x80000000000000009138Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.749{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ka.dll2025-10-29 13:15:13.749NT AUTHORITY\SYSTEM 11241100x80000000000000009139Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.751{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_kk.dll2025-10-29 13:15:13.751NT AUTHORITY\SYSTEM 11241100x80000000000000009140Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.753{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_km.dll2025-10-29 13:15:13.753NT AUTHORITY\SYSTEM 11241100x80000000000000009141Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.755{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_kok.dll2025-10-29 13:15:13.755NT AUTHORITY\SYSTEM 11241100x80000000000000009142Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.759{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_lb.dll2025-10-29 13:15:13.757NT AUTHORITY\SYSTEM 11241100x80000000000000009143Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.761{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_lo.dll2025-10-29 13:15:13.759NT AUTHORITY\SYSTEM 11241100x80000000000000009144Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.763{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_mi.dll2025-10-29 13:15:13.763NT AUTHORITY\SYSTEM 11241100x80000000000000009145Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.765{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_mk.dll2025-10-29 13:15:13.765NT AUTHORITY\SYSTEM 11241100x80000000000000009146Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.767{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_mt.dll2025-10-29 13:15:13.767NT AUTHORITY\SYSTEM 11241100x80000000000000009147Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.769{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ne.dll2025-10-29 13:15:13.769NT AUTHORITY\SYSTEM 11241100x80000000000000009148Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.769{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_nn.dll2025-10-29 13:15:13.769NT AUTHORITY\SYSTEM 11241100x80000000000000009149Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.771{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_or.dll2025-10-29 13:15:13.771NT AUTHORITY\SYSTEM 11241100x80000000000000009150Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.773{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_pa.dll2025-10-29 13:15:13.773NT AUTHORITY\SYSTEM 11241100x80000000000000009151Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.775{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_quz.dll2025-10-29 13:15:13.775NT AUTHORITY\SYSTEM 11241100x80000000000000009152Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.777{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_sq.dll2025-10-29 13:15:13.777NT AUTHORITY\SYSTEM 11241100x80000000000000009153Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.779{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_sr-Cyrl-BA.dll2025-10-29 13:15:13.779NT AUTHORITY\SYSTEM 11241100x80000000000000009154Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.781{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_sr-Cyrl-RS.dll2025-10-29 13:15:13.781NT AUTHORITY\SYSTEM 11241100x80000000000000009155Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.785{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_sr-Latn-RS.dll2025-10-29 13:15:13.783NT AUTHORITY\SYSTEM 11241100x80000000000000009156Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.785{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_tt.dll2025-10-29 13:15:13.785NT AUTHORITY\SYSTEM 11241100x80000000000000009157Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:13.789{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\msedgeupdateres_ug.dll2025-10-29 13:15:13.787NT AUTHORITY\SYSTEM 11241100x80000000000000009158Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:13.793{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exeC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdateSetup.exe2025-10-29 13:15:13.793NT AUTHORITY\SYSTEM 154100x80000000000000009159Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:13.857{8223a6b9-1361-6902-0d01-000000002b00}12036C:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdate.exe1.3.205.9Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{5AE6621B-519F-4927-8A81-D8AAEA2C2B8B}"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.199.11\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5F05B17D22A78436FACD57719D38DC5D,SHA256=9A41AD630CC919A742CF0B764D0E34EA9BB8558D1FA803A0E5DFFF00C4E8410B,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1361-6902-0b01-000000002b00}11940C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{99822E8A-05C1-4F8F-9726-C228B86D2F1C}\MicrosoftEdgeUpdateSetup_X86_1.3.205.9.exe" /update /sessionid "{5AE6621B-519F-4927-8A81-D8AAEA2C2B8B}"NT AUTHORITY\SYSTEM 13241300x80000000000000009160Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:15:14.443{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|9134d7ae24cae7a1\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\install\{99822e8a-05c1-4f8f-9726-c228b86d2f1c}\microsoftedgeupdatesetup_x86_1.3.205.9.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009161Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:15:14.443{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|9134d7ae24cae7a1\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009162Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:15:14.443{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|9134d7ae24cae7a1\LinkDate10/20/2025 17:59:17NT AUTHORITY\SYSTEM 13241300x80000000000000009163Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:15:14.443{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|9134d7ae24cae7a1\BinProductVersion1.3.205.9NT AUTHORITY\SYSTEM 13241300x80000000000000009164Microsoft-Windows-Sysmon/Operationalsoc101win11T1183,IFEOSetValue2025-10-29 13:15:14.749{8223a6b9-1361-6902-0d01-000000002b00}12036C:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdate.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidationDWORD (0x00000000)NT AUTHORITY\SYSTEM 154100x80000000000000009165Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:14.780{8223a6b9-1362-6902-0e01-000000002b00}12076C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvcC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1361-6902-0d01-000000002b00}12036C:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{5AE6621B-519F-4927-8A81-D8AAEA2C2B8B}"NT AUTHORITY\SYSTEM 154100x80000000000000009166Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:15.337{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1361-6902-0d01-000000002b00}12036C:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{5AE6621B-519F-4927-8A81-D8AAEA2C2B8B}"NT AUTHORITY\SYSTEM 154100x80000000000000009167Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:15.588{8223a6b9-1363-6902-1001-000000002b00}12148C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exe1.3.205.9Microsoft Edge Update COM Registration HelperMicrosoft Edge UpdateMicrosoft CorporationMicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=2F395730E8B4B3699A82E363A5DC6DAB,SHA256=15FB17B738E1A1F8F5020D36D54C04EE5E6CC0C1F491DB8389BBA88CE2A5BB92,IMPHASH=9AF6910BC05E23C793BC38F5603DF9F1{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverNT AUTHORITY\SYSTEM 13241300x80000000000000009168Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:15.781{8223a6b9-1363-6902-1001-000000002b00}12148C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exeHKCR\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine_64.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009169Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:15.781{8223a6b9-1363-6902-1001-000000002b00}12148C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exeHKCR\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine_64.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009170Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:15.781{8223a6b9-1363-6902-1001-000000002b00}12148C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exeHKCR\CLSID\{7808D8CD-FEB3-4EA0-88FE-FC6909634FC2}\InProcServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine_64.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009171Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:15.953{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeHKCR\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009172Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:15.956{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeHKCR\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009173Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:15.956{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeHKCR\WOW6432Node\CLSID\{7808D8CD-FEB3-4EA0-88FE-FC6909634FC2}\InProcServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine.dllNT AUTHORITY\SYSTEM 154100x80000000000000009174Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:15.968{8223a6b9-1363-6902-1101-000000002b00}12172C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exe1.3.205.9Microsoft Edge Update COM Registration HelperMicrosoft Edge UpdateMicrosoft CorporationMicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=2F395730E8B4B3699A82E363A5DC6DAB,SHA256=15FB17B738E1A1F8F5020D36D54C04EE5E6CC0C1F491DB8389BBA88CE2A5BB92,IMPHASH=9AF6910BC05E23C793BC38F5603DF9F1{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverNT AUTHORITY\SYSTEM 13241300x80000000000000009175Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:16.079{8223a6b9-1363-6902-1101-000000002b00}12172C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exeHKCR\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine_64.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009176Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:16.079{8223a6b9-1363-6902-1101-000000002b00}12172C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exeHKCR\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine_64.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009177Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:16.079{8223a6b9-1363-6902-1101-000000002b00}12172C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exeHKCR\CLSID\{7808D8CD-FEB3-4EA0-88FE-FC6909634FC2}\InProcServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine_64.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009178Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:16.407{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeHKCR\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009179Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:16.732{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeHKCR\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009180Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:16.882{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeHKCR\WOW6432Node\CLSID\{7808D8CD-FEB3-4EA0-88FE-FC6909634FC2}\InProcServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine.dllNT AUTHORITY\SYSTEM 22542200x80000000000000009181Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:15.461{8223a6b9-135c-6902-0101-000000002b00}3492wpad1460-C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exesoc101win11\Administrator 22542200x80000000000000009182Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:15.901{8223a6b9-135f-6902-0601-000000002b00}11632github.com0::ffff:140.82.114.3;C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administrator 154100x80000000000000009183Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:17.315{8223a6b9-1365-6902-1201-000000002b00}12200C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exe1.3.205.9Microsoft Edge Update COM Registration HelperMicrosoft Edge UpdateMicrosoft CorporationMicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=2F395730E8B4B3699A82E363A5DC6DAB,SHA256=15FB17B738E1A1F8F5020D36D54C04EE5E6CC0C1F491DB8389BBA88CE2A5BB92,IMPHASH=9AF6910BC05E23C793BC38F5603DF9F1{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverNT AUTHORITY\SYSTEM 13241300x80000000000000009184Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:15:17.421{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|585925c6db26e948\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\1.3.205.9\microsoftedgeupdatecomregistershell64.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009185Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:15:17.421{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|585925c6db26e948\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009186Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:15:17.421{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|585925c6db26e948\LinkDate10/20/2025 17:57:04NT AUTHORITY\SYSTEM 13241300x80000000000000009187Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:15:17.421{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|585925c6db26e948\BinProductVersion1.3.205.9NT AUTHORITY\SYSTEM 354300x80000000000000009188Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:16.029{8223a6b9-135f-6902-0601-000000002b00}11632C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49798-false140.82.114.3lb-140-82-114-3-iad.github.com443https 154100x80000000000000009189Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:17.504{8223a6b9-1365-6902-1301-000000002b00}12224C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe $(Arg0)C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 13241300x80000000000000009190Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:17.756{8223a6b9-1365-6902-1201-000000002b00}12200C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exeHKCR\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine_64.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009191Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:17.756{8223a6b9-1365-6902-1201-000000002b00}12200C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exeHKCR\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine_64.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009192Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:17.756{8223a6b9-1365-6902-1201-000000002b00}12200C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\MicrosoftEdgeUpdateComRegisterShell64.exeHKCR\CLSID\{7808D8CD-FEB3-4EA0-88FE-FC6909634FC2}\InProcServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine_64.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009193Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:17.804{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeHKCR\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009194Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:17.806{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeHKCR\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009195Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:17.806{8223a6b9-1363-6902-0f01-000000002b00}12124C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeHKCR\WOW6432Node\CLSID\{7808D8CD-FEB3-4EA0-88FE-FC6909634FC2}\InProcServer32\(Default)C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\psmachine.dllNT AUTHORITY\SYSTEM 154100x80000000000000009196Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:18.476{8223a6b9-1366-6902-1401-000000002b00}7244C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMDUuOSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4NS4yNyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins1QUU2NjIxQi01MTlGLTQ5MjctOEE4MS1EOEFBRUEyQzJCOEJ9IiB1c2VyaWQ9IntBMkM1RThDRS03OTVCLTQ0N0YtOEJGRi04QkI0RjA2QUI1QjV9IiBpbnN0YWxsc291cmNlPSJzZWxmdXBkYXRlIiByZXF1ZXN0aWQ9InsyNTY4NEEzMC0yMzhELTQ3MEQtOURDQy04MzUwNzlFQ0Q5QzJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iMjAiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC40OTQ2IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTYyIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJWTXdhcmUsIEluYy4iIHByb2R1Y3RfbmFtZT0iVk13YXJlMjAsMSIvPjxleHAgZXRhZz0iJnF1b3Q7SEFycXM2M2pKbWt2MWJYVm9OUHE4ekE2MFUrek8wV2ltaTRrd0hPSGVkWT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5OS4xMSIgbmV4dHZlcnNpb249IjEuMy4yMDUuOSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjM1MSIgaW5zdGFsbGRhdGV0aW1lPSIxNzMxMzUwNjM0IiBjb2hvcnQ9InJyZkAwLjc2Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MTI4NTQ3NDgiLz48L2FwcD48L3JlcXVlc3Q-C:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1361-6902-0d01-000000002b00}12036C:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU50DA.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{5AE6621B-519F-4927-8A81-D8AAEA2C2B8B}"NT AUTHORITY\SYSTEM 354300x80000000000000009197Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:17.671{8223a6b9-135f-6902-0601-000000002b00}11632C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49799-false185.199.108.133-443https 22542200x80000000000000009198Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:17.588{8223a6b9-135f-6902-0601-000000002b00}11632release-assets.githubusercontent.com0::ffff:185.199.108.133;::ffff:185.199.109.133;::ffff:185.199.111.133;::ffff:185.199.110.133;C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administrator 22542200x80000000000000009199Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:25.108{8223a6b9-135c-6902-0101-000000002b00}3492res.public.onecdn.static.microsoft1460-C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exesoc101win11\Administrator 11241100x80000000000000009200Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:25.702{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe2025-10-29 13:15:25.702soc101win11\Administrator 22542200x80000000000000009201Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:25.156{8223a6b9-135c-6902-0101-000000002b00}3492portal.office.com1460-C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exesoc101win11\Administrator 22542200x80000000000000009202Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:25.156{8223a6b9-135c-6902-0101-000000002b00}3492outlook.office.com1460-C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exesoc101win11\Administrator 154100x80000000000000009203Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:29.396{8223a6b9-1371-6902-1501-000000002b00}11832C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe25.189.0928.0002Microsoft OneDrive (64 bit) SetupMicrosoft OneDriveMicrosoft CorporationOneDriveSetup.exe"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart /updateSource:ODU C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=53B18DFEF72D5EA11038FE17165C6EB4,SHA256=33457526F3275E838638342C106E875B987C5968C6FE0F60873F5556B29CA2CA,IMPHASH=F17F9C2316EA64278FDE2D0FD2FBC657{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /backgroundsoc101win11\Administrator 154100x80000000000000009204Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:29.735{8223a6b9-1371-6902-1601-000000002b00}11820C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 12241200x80000000000000009205Microsoft-Windows-Sysmon/Operationalsoc101win11InvDBDeleteValue2025-10-29 13:15:29.804{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009206Microsoft-Windows-Sysmon/Operationalsoc101win11InvDBSetValue2025-10-29 13:15:29.814{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeBinary DataNT AUTHORITY\SYSTEM 154100x80000000000000009207Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:30.998{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe25.189.0928.0002Microsoft OneDrive (64 bit) SetupMicrosoft OneDriveMicrosoft CorporationOneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ReLaunchOD4AppHarness /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepairC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=53B18DFEF72D5EA11038FE17165C6EB4,SHA256=33457526F3275E838638342C106E875B987C5968C6FE0F60873F5556B29CA2CA,IMPHASH=F17F9C2316EA64278FDE2D0FD2FBC657{8223a6b9-1371-6902-1501-000000002b00}11832C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart /updateSource:ODU soc101win11\Administrator 22542200x80000000000000009208Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:30.404{8223a6b9-1371-6902-1501-000000002b00}11832ecs.office.com0type: 5 ecs.office.trafficmanager.net;type: 5 dual-s-0005-office.config.skype.com;type: 5 ecs-office.s-0005.dual-s-msedge.net;type: 5 s-0005.dual-s-msedge.net;::ffff:52.123.128.14;::ffff:52.123.129.14;C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exesoc101win11\Administrator 354300x80000000000000009209Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:30.475{8223a6b9-1371-6902-1501-000000002b00}11832C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49806-false52.123.128.14-443https 13241300x80000000000000009210Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:15:31.991{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|d3f263bd663e4335\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\update\onedrivesetup.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009211Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:15:31.991{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|d3f263bd663e4335\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009212Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:15:31.991{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|d3f263bd663e4335\LinkDate11/28/2034 23:04:51NT AUTHORITY\SYSTEM 13241300x80000000000000009213Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:15:31.991{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|d3f263bd663e4335\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 11241100x80000000000000009214Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.281{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\adal.dll2025-10-29 13:15:32.279soc101win11\Administrator 22542200x80000000000000009215Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:30.486{8223a6b9-135c-6902-0101-000000002b00}3492res.public.onecdn.static.microsoft0type: 5 res-ocdi-public.trafficmanager.net;type: 5 res-1.public.onecdn.static.microsoft;type: 5 res-ocdi-stls-prod.edgesuite.net;type: 5 a434.dscd.akamai.net;23.219.155.169;23.219.155.181;23.219.155.177;23.219.155.159;23.219.155.162;23.219.155.183;23.219.155.179;23.219.155.173;23.219.155.165;C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exesoc101win11\Administrator 11241100x80000000000000009216Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.455{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-console-l1-1-0.dll2025-10-29 13:15:32.453soc101win11\Administrator 11241100x80000000000000009217Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.457{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-console-l1-2-0.dll2025-10-29 13:15:32.457soc101win11\Administrator 11241100x80000000000000009218Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.460{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-datetime-l1-1-0.dll2025-10-29 13:15:32.460soc101win11\Administrator 11241100x80000000000000009219Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.466{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-debug-l1-1-0.dll2025-10-29 13:15:32.465soc101win11\Administrator 11241100x80000000000000009220Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.468{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-errorhandling-l1-1-0.dll2025-10-29 13:15:32.468soc101win11\Administrator 11241100x80000000000000009221Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.472{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-fibers-l1-1-0.dll2025-10-29 13:15:32.472soc101win11\Administrator 11241100x80000000000000009222Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.474{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-file-l1-1-0.dll2025-10-29 13:15:32.474soc101win11\Administrator 11241100x80000000000000009223Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.478{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-file-l1-2-0.dll2025-10-29 13:15:32.478soc101win11\Administrator 11241100x80000000000000009224Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.483{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-file-l2-1-0.dll2025-10-29 13:15:32.481soc101win11\Administrator 11241100x80000000000000009225Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.485{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-handle-l1-1-0.dll2025-10-29 13:15:32.485soc101win11\Administrator 154100x80000000000000009226Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:32.483{8223a6b9-1374-6902-1901-000000002b00}6952C:\Windows\UUS\Packages\Preview\amd64\wuaucltcore.exe1407.2506.11012.0Windows UpdateMicrosoft® Windows® Operating SystemMicrosoft Corporationwuaucltcore.exe"C:\WINDOWS\uus\packages\preview\AMD64\wuaucltcore.exe" /DeploymentHandlerFullPath \\?\C:\Windows\UUS\Packages\Preview\AMD64\UpdateDeploy.dll /ClassId 5b07b36c-3860-4cc9-bef4-a699ac1018cf /RunHandlerComServerC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=EA98A3ECEF7902605B361FC16D3D8081,SHA256=9C685412986F3939E7A84E62B09E319F4FA5B5C2B7006DE3441F6D4BB0CAC02D,IMPHASH=5FB5459A8931EA77DFAA79FC37CD9756{8223a6b9-1317-6902-3f00-000000002b00}3008C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauservNT AUTHORITY\SYSTEM 11241100x80000000000000009227Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.488{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-heap-l1-1-0.dll2025-10-29 13:15:32.488soc101win11\Administrator 11241100x80000000000000009228Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.491{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-interlocked-l1-1-0.dll2025-10-29 13:15:32.491soc101win11\Administrator 11241100x80000000000000009229Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.496{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-libraryloader-l1-1-0.dll2025-10-29 13:15:32.495soc101win11\Administrator 11241100x80000000000000009230Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.500{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-localization-l1-2-0.dll2025-10-29 13:15:32.500soc101win11\Administrator 11241100x80000000000000009231Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.505{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-memory-l1-1-0.dll2025-10-29 13:15:32.503soc101win11\Administrator 11241100x80000000000000009232Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.510{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-namedpipe-l1-1-0.dll2025-10-29 13:15:32.510soc101win11\Administrator 11241100x80000000000000009233Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.514{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-processenvironment-l1-1-0.dll2025-10-29 13:15:32.514soc101win11\Administrator 11241100x80000000000000009234Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.518{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-processthreads-l1-1-0.dll2025-10-29 13:15:32.518soc101win11\Administrator 11241100x80000000000000009235Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.521{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-processthreads-l1-1-1.dll2025-10-29 13:15:32.521soc101win11\Administrator 11241100x80000000000000009236Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.527{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-profile-l1-1-0.dll2025-10-29 13:15:32.524soc101win11\Administrator 11241100x80000000000000009237Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.533{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-rtlsupport-l1-1-0.dll2025-10-29 13:15:32.530soc101win11\Administrator 11241100x80000000000000009238Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.535{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-string-l1-1-0.dll2025-10-29 13:15:32.535soc101win11\Administrator 11241100x80000000000000009239Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.539{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-synch-l1-1-0.dll2025-10-29 13:15:32.539soc101win11\Administrator 11241100x80000000000000009240Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.544{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-synch-l1-2-0.dll2025-10-29 13:15:32.543soc101win11\Administrator 11241100x80000000000000009241Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.549{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-sysinfo-l1-1-0.dll2025-10-29 13:15:32.549soc101win11\Administrator 11241100x80000000000000009242Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.553{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-timezone-l1-1-0.dll2025-10-29 13:15:32.551soc101win11\Administrator 11241100x80000000000000009243Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:32.553{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\Install\AM_Engine_Patch_1.1.25080.5.exe2025-10-29 13:15:32.553NT AUTHORITY\SYSTEM 11241100x80000000000000009244Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.556{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-core-util-l1-1-0.dll2025-10-29 13:15:32.555soc101win11\Administrator 11241100x80000000000000009245Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.570{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-conio-l1-1-0.dll2025-10-29 13:15:32.569soc101win11\Administrator 11241100x80000000000000009246Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.573{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-convert-l1-1-0.dll2025-10-29 13:15:32.573soc101win11\Administrator 11241100x80000000000000009247Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.575{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-environment-l1-1-0.dll2025-10-29 13:15:32.575soc101win11\Administrator 11241100x80000000000000009248Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.579{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-filesystem-l1-1-0.dll2025-10-29 13:15:32.577soc101win11\Administrator 11241100x80000000000000009249Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.581{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-heap-l1-1-0.dll2025-10-29 13:15:32.581soc101win11\Administrator 11241100x80000000000000009250Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.583{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-locale-l1-1-0.dll2025-10-29 13:15:32.583soc101win11\Administrator 11241100x80000000000000009251Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.585{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-math-l1-1-0.dll2025-10-29 13:15:32.585soc101win11\Administrator 11241100x80000000000000009252Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.587{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-multibyte-l1-1-0.dll2025-10-29 13:15:32.587soc101win11\Administrator 11241100x80000000000000009253Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.590{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-private-l1-1-0.dll2025-10-29 13:15:32.590soc101win11\Administrator 11241100x80000000000000009254Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.593{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-process-l1-1-0.dll2025-10-29 13:15:32.593soc101win11\Administrator 11241100x80000000000000009255Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.598{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-runtime-l1-1-0.dll2025-10-29 13:15:32.598soc101win11\Administrator 11241100x80000000000000009256Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.601{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-stdio-l1-1-0.dll2025-10-29 13:15:32.601soc101win11\Administrator 11241100x80000000000000009257Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.603{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-string-l1-1-0.dll2025-10-29 13:15:32.603soc101win11\Administrator 11241100x80000000000000009258Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.605{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-time-l1-1-0.dll2025-10-29 13:15:32.605soc101win11\Administrator 11241100x80000000000000009259Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.607{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\api-ms-win-crt-utility-l1-1-0.dll2025-10-29 13:15:32.607soc101win11\Administrator 11241100x80000000000000009260Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.635{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\CheckboxWindows.dll2025-10-29 13:15:32.635soc101win11\Administrator 11241100x80000000000000009261Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:32.643{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\CollectSyncLogs.bat2025-10-29 13:15:32.643soc101win11\Administrator 11241100x80000000000000009262Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.651{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\concrt140.dll2025-10-29 13:15:32.651soc101win11\Administrator 11241100x80000000000000009263Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.660{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\concrt140_app.dll2025-10-29 13:15:32.660soc101win11\Administrator 11241100x80000000000000009264Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.674{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\ETWlog.dll2025-10-29 13:15:32.674soc101win11\Administrator 11241100x80000000000000009265Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:32.676{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileCoAuth.exe2025-10-29 13:15:32.676soc101win11\Administrator 154100x80000000000000009266Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:32.689{8223a6b9-1374-6902-1a01-000000002b00}7392C:\Windows\SoftwareDistribution\Download\Install\AM_Engine_Patch_1.1.25080.5.exe1.1.25090.3001AntiMalware Definition UpdateMicrosoft Malware ProtectionMicrosoft CorporationAM_Engine_Patch_1.1.25080.5.exe"C:\WINDOWS\SoftwareDistribution\Download\Install\AM_Engine_Patch_1.1.25080.5.exe" C:\WINDOWS\SoftwareDistribution\Download\Install\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=2A37370C5C7FD3C8F00B0FB28DEAC89D,SHA256=52874F035D0D83FAC3409CBEE543B24A1B08F318384BAFFE7D53CADD73461B55,IMPHASH=52CEE9C1BC4BDA1F4F98A36E5EF61615{8223a6b9-1374-6902-1901-000000002b00}6952C:\Windows\UUS\Packages\Preview\amd64\wuaucltcore.exe"C:\WINDOWS\uus\packages\preview\AMD64\wuaucltcore.exe" /DeploymentHandlerFullPath \\?\C:\Windows\UUS\Packages\Preview\AMD64\UpdateDeploy.dll /ClassId 5b07b36c-3860-4cc9-bef4-a699ac1018cf /RunHandlerComServerNT AUTHORITY\SYSTEM 11241100x80000000000000009267Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.722{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileCoAuthLib64.dll2025-10-29 13:15:32.720soc101win11\Administrator 11241100x80000000000000009268Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.732{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSync.LocalizedResources.dll2025-10-29 13:15:32.730soc101win11\Administrator 11241100x80000000000000009269Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.742{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSync.Resources.dll2025-10-29 13:15:32.742soc101win11\Administrator 11241100x80000000000000009270Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:32.805{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncClient.dll2025-10-29 13:15:32.805soc101win11\Administrator 154100x80000000000000009271Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:32.816{8223a6b9-1374-6902-1b01-000000002b00}12188C:\Windows\System32\MpSigStub.exe1.1.24010.2001 (7122f19e8a45ed98fbe41ea0bdadf251e45717f9)Microsoft Malware Protection Signature Update StubMicrosoft Malware ProtectionMicrosoft CorporationMpSigStub.exeC:\WINDOWS\system32\MpSigStub.exe /stub 1.1.24010.2001 /payload 1.1.25090.3001 /MpWUStub /program C:\WINDOWS\SoftwareDistribution\Download\Install\AM_Engine_Patch_1.1.25080.5.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=71CF589293424C4389202C7F1752FB2D,SHA256=071B0D3A08503A8B88AEEDA1D20F371A563377028F6E252DC66CCE60AB8F823E,IMPHASH=73D10F665B566678AC1DDF9942FDAEA0{8223a6b9-1374-6902-1901-000000002b00}6952C:\Windows\UUS\Packages\Preview\amd64\wuaucltcore.exe"C:\WINDOWS\uus\packages\preview\AMD64\wuaucltcore.exe" /DeploymentHandlerFullPath \\?\C:\Windows\UUS\Packages\Preview\AMD64\UpdateDeploy.dll /ClassId 5b07b36c-3860-4cc9-bef4-a699ac1018cf /RunHandlerComServerNT AUTHORITY\SYSTEM 11241100x80000000000000009272Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:33.055{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncConfig.exe2025-10-29 13:15:33.053soc101win11\Administrator 11241100x80000000000000009273Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.075{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncCxP.dll2025-10-29 13:15:33.075soc101win11\Administrator 11241100x80000000000000009274Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.088{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncCxPImpl.dll2025-10-29 13:15:33.088soc101win11\Administrator 11241100x80000000000000009275Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.108{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncEvents.dll2025-10-29 13:15:33.107soc101win11\Administrator 11241100x80000000000000009276Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.114{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncFAL.dll2025-10-29 13:15:33.114soc101win11\Administrator 11241100x80000000000000009277Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.124{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncFALWB.dll2025-10-29 13:15:33.124soc101win11\Administrator 11241100x80000000000000009278Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.137{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncFS.dll2025-10-29 13:15:33.137soc101win11\Administrator 11241100x80000000000000009279Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.157{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncFSCache.dll2025-10-29 13:15:33.155soc101win11\Administrator 11241100x80000000000000009280Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.167{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncFSDbfs.dll2025-10-29 13:15:33.167soc101win11\Administrator 11241100x80000000000000009281Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.188{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncFSDbfsWB.dll2025-10-29 13:15:33.188soc101win11\Administrator 11241100x80000000000000009282Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.195{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncFSNtfs.dll2025-10-29 13:15:33.195soc101win11\Administrator 11241100x80000000000000009283Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.213{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncFSNtfsWB.dll2025-10-29 13:15:33.213soc101win11\Administrator 11241100x80000000000000009284Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:33.227{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncHelper.exe2025-10-29 13:15:33.227soc101win11\Administrator 11241100x80000000000000009285Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.301{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncHost.dll2025-10-29 13:15:33.301soc101win11\Administrator 11241100x80000000000000009286Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.313{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncRNWin32Lib.dll2025-10-29 13:15:33.313soc101win11\Administrator 11241100x80000000000000009287Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.323{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncSessions.dll2025-10-29 13:15:33.323soc101win11\Administrator 13241300x80000000000000009288Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:15:33.399{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\am_engine_patch_|e6a10fb4f251356a\LowerCaseLongPathc:\windows\softwaredistribution\download\install\am_engine_patch_1.1.25080.5.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009289Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:15:33.399{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\am_engine_patch_|e6a10fb4f251356a\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009290Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:15:33.399{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\am_engine_patch_|e6a10fb4f251356a\LinkDate09/09/2025 23:27:27NT AUTHORITY\SYSTEM 13241300x80000000000000009291Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:15:33.399{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\am_engine_patch_|e6a10fb4f251356a\BinProductVersion1.1.25090.3001NT AUTHORITY\SYSTEM 11241100x80000000000000009292Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.451{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dll2025-10-29 13:15:33.451soc101win11\Administrator 11241100x80000000000000009293Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.485{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncSqlite3.dll2025-10-29 13:15:33.485soc101win11\Administrator 11241100x80000000000000009294Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.513{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncTelemetryExtensions.dll2025-10-29 13:15:33.513soc101win11\Administrator 11241100x80000000000000009295Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.529{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncViews.dll2025-10-29 13:15:33.529soc101win11\Administrator 11241100x80000000000000009296Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.596{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\hermes.dll2025-10-29 13:15:33.596soc101win11\Administrator 11241100x80000000000000009297Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.724{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\ipcfile.dll2025-10-29 13:15:33.724soc101win11\Administrator 11241100x80000000000000009298Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.744{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\ipcsecproc.dll2025-10-29 13:15:33.744soc101win11\Administrator 11241100x80000000000000009299Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.776{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libbz2-1.dll2025-10-29 13:15:33.776soc101win11\Administrator 11241100x80000000000000009300Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.782{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libcrypto-3-x64.dll2025-10-29 13:15:33.782soc101win11\Administrator 11241100x80000000000000009301Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.899{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libEGL.dll2025-10-29 13:15:33.899soc101win11\Administrator 11241100x80000000000000009302Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.901{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libffi-8.dll2025-10-29 13:15:33.901soc101win11\Administrator 11241100x80000000000000009303Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.905{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libgcc_s_seh-1.dll2025-10-29 13:15:33.905soc101win11\Administrator 11241100x80000000000000009304Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.915{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libgio-2.0-0.dll2025-10-29 13:15:33.913soc101win11\Administrator 11241100x80000000000000009305Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:33.979{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libGLESv2.dll2025-10-29 13:15:33.979soc101win11\Administrator 11241100x80000000000000009306Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.074{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libglib-2.0-0.dll2025-10-29 13:15:34.074soc101win11\Administrator 11241100x80000000000000009307Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:34.082{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\Install\AM_Base_Patch1.exe2025-10-29 13:15:34.082NT AUTHORITY\SYSTEM 11241100x80000000000000009308Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.110{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libgmodule-2.0-0.dll2025-10-29 13:15:34.110soc101win11\Administrator 11241100x80000000000000009309Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.114{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libgobject-2.0-0.dll2025-10-29 13:15:34.114soc101win11\Administrator 11241100x80000000000000009310Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.140{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libgsf-1-114.dll2025-10-29 13:15:34.140soc101win11\Administrator 11241100x80000000000000009311Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.182{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libiconv-2.dll2025-10-29 13:15:34.182soc101win11\Administrator 11241100x80000000000000009312Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.204{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libintl-8.dll2025-10-29 13:15:34.203soc101win11\Administrator 11241100x80000000000000009313Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.210{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\liblzma-5.dll2025-10-29 13:15:34.208soc101win11\Administrator 11241100x80000000000000009314Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.216{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libpcre2-8-0.dll2025-10-29 13:15:34.216soc101win11\Administrator 11241100x80000000000000009315Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.239{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libssl-3-x64.dll2025-10-29 13:15:34.239soc101win11\Administrator 11241100x80000000000000009316Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.291{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libwinpthread-1.dll2025-10-29 13:15:34.291soc101win11\Administrator 11241100x80000000000000009317Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.295{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\libxml2-2.dll2025-10-29 13:15:34.295soc101win11\Administrator 11241100x80000000000000009318Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.337{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\LoggingPlatform.dll2025-10-29 13:15:34.337soc101win11\Administrator 11241100x80000000000000009319Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.347{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\LogUploader.dll2025-10-29 13:15:34.347soc101win11\Administrator 11241100x80000000000000009320Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.433{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Microsoft.ReactNative.dll2025-10-29 13:15:34.431soc101win11\Administrator 11241100x80000000000000009321Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.514{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Microsoft.SharePoint.Calc.dll2025-10-29 13:15:34.514soc101win11\Administrator 11241100x80000000000000009322Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:34.532{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Microsoft.SharePoint.NativeMessagingClient.exe2025-10-29 13:15:34.532soc101win11\Administrator 11241100x80000000000000009323Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.534{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Microsoft.Toolkit.Win32.UI.XamlHost.dll2025-10-29 13:15:34.534soc101win11\Administrator 11241100x80000000000000009324Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.538{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Microsoft.UI.Xaml.dll2025-10-29 13:15:34.538soc101win11\Administrator 154100x80000000000000009325Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:34.521{8223a6b9-1376-6902-1c01-000000002b00}7680C:\Windows\SoftwareDistribution\Download\Install\AM_Base_Patch1.exe1.439.0.0AntiMalware Definition UpdateMicrosoft Malware ProtectionMicrosoft CorporationAM_Base_Patch1.exe"C:\WINDOWS\SoftwareDistribution\Download\Install\AM_Base_Patch1.exe" C:\WINDOWS\SoftwareDistribution\Download\Install\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=B4A1BA812F9B6EEEB382D078F7666F1D,SHA256=75C90EBDE68F663D12DE609217416057A7A4CD64C51FB50BA6B7DEFB62D63675,IMPHASH=52CEE9C1BC4BDA1F4F98A36E5EF61615{8223a6b9-1374-6902-1901-000000002b00}6952C:\Windows\UUS\Packages\Preview\amd64\wuaucltcore.exe"C:\WINDOWS\uus\packages\preview\AMD64\wuaucltcore.exe" /DeploymentHandlerFullPath \\?\C:\Windows\UUS\Packages\Preview\AMD64\UpdateDeploy.dll /ClassId 5b07b36c-3860-4cc9-bef4-a699ac1018cf /RunHandlerComServerNT AUTHORITY\SYSTEM 11241100x80000000000000009326Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.807{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\minizip.dll2025-10-29 13:15:34.805soc101win11\Administrator 11241100x80000000000000009327Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.815{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\mip_ClientTelemetry.dll2025-10-29 13:15:34.813soc101win11\Administrator 11241100x80000000000000009328Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.898{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\mip_core.dll2025-10-29 13:15:34.898soc101win11\Administrator 11241100x80000000000000009329Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:34.925{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe2025-10-29 13:15:34.925NT AUTHORITY\SYSTEM 11241100x80000000000000009330Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:34.986{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\mip_file_sdk.dll2025-10-29 13:15:34.986soc101win11\Administrator 11241100x80000000000000009331Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.181{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\mip_protection_sdk.dll2025-10-29 13:15:35.180soc101win11\Administrator 11241100x80000000000000009332Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.218{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\mip_upe_sdk.dll2025-10-29 13:15:35.218soc101win11\Administrator 11241100x80000000000000009333Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.242{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\msipc.dll2025-10-29 13:15:35.242soc101win11\Administrator 154100x80000000000000009334Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:35.228{8223a6b9-1377-6902-1d01-000000002b00}12108C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe1.439.539.0AntiMalware Definition UpdateMicrosoft Malware ProtectionMicrosoft CorporationAM_Delta.exe"C:\WINDOWS\SoftwareDistribution\Download\Install\AM_Delta.exe" WD /qC:\WINDOWS\SoftwareDistribution\Download\Install\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=01038B13DE7210A0C57107FB21E99C93,SHA256=149D490710188CCD9987730C467F5653A6114C3165766CA37EEC93B10039F1E9,IMPHASH=52CEE9C1BC4BDA1F4F98A36E5EF61615{8223a6b9-1374-6902-1901-000000002b00}6952C:\Windows\UUS\Packages\Preview\amd64\wuaucltcore.exe"C:\WINDOWS\uus\packages\preview\AMD64\wuaucltcore.exe" /DeploymentHandlerFullPath \\?\C:\Windows\UUS\Packages\Preview\AMD64\UpdateDeploy.dll /ClassId 5b07b36c-3860-4cc9-bef4-a699ac1018cf /RunHandlerComServerNT AUTHORITY\SYSTEM 11241100x80000000000000009335Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.298{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\msvcp140.dll2025-10-29 13:15:35.296soc101win11\Administrator 11241100x80000000000000009336Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.308{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\msvcp140_1.dll2025-10-29 13:15:35.306soc101win11\Administrator 11241100x80000000000000009337Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.310{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\msvcp140_1_app.dll2025-10-29 13:15:35.310soc101win11\Administrator 11241100x80000000000000009338Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.315{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\msvcp140_2_app.dll2025-10-29 13:15:35.315soc101win11\Administrator 11241100x80000000000000009339Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.318{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\msvcp140_app.dll2025-10-29 13:15:35.318soc101win11\Administrator 11241100x80000000000000009340Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.324{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\msvcp140_atomic_wait.dll2025-10-29 13:15:35.324soc101win11\Administrator 11241100x80000000000000009341Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.326{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\nh.dll2025-10-29 13:15:35.326soc101win11\Administrator 11241100x80000000000000009342Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.363{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.App.dll2025-10-29 13:15:35.362soc101win11\Administrator 11241100x80000000000000009343Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.477{8223a6b9-1374-6902-1b01-000000002b00}12188C:\WINDOWS\system32\MpSigStub.exeC:\Windows\Temp\4F9F0B2D-48D1-4BEE-9024-77BD3E89EB992f9c.1dc48d61b0abea4\mpengine.dll2025-10-29 13:15:35.477NT AUTHORITY\SYSTEM 11241100x80000000000000009344Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:35.482{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.App.exe2025-10-29 13:15:35.482soc101win11\Administrator 11241100x80000000000000009345Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:35.499{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.exe2025-10-29 13:15:35.499soc101win11\Administrator 11241100x80000000000000009346Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:35.550{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.Sync.Service.dll2025-10-29 13:15:35.550soc101win11\Administrator 11241100x80000000000000009347Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:36.104{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.Sync.Service.exe2025-10-29 13:15:36.104soc101win11\Administrator 11241100x80000000000000009348Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:36.120{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.Sync.Service.HttpSvr.dll2025-10-29 13:15:36.120soc101win11\Administrator 11241100x80000000000000009349Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:36.142{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.Sync.Service.WebSocketClient.dll2025-10-29 13:15:36.140soc101win11\Administrator 11241100x80000000000000009350Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:36.162{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveActionHelper.exe2025-10-29 13:15:36.162soc101win11\Administrator 11241100x80000000000000009351Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:36.172{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveFileLauncher.exe2025-10-29 13:15:36.172soc101win11\Administrator 11241100x80000000000000009352Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:36.182{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveLauncher.exe2025-10-29 13:15:36.182soc101win11\Administrator 11241100x80000000000000009353Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:36.197{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrivePatcher.exe2025-10-29 13:15:36.197soc101win11\Administrator 11241100x80000000000000009354Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:36.272{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveStandaloneUpdater.exe2025-10-29 13:15:36.272soc101win11\Administrator 11241100x80000000000000009355Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:36.596{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveTelemetryExperimental.dll2025-10-29 13:15:36.596soc101win11\Administrator 11241100x80000000000000009356Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:36.636{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveTelemetryStable.dll2025-10-29 13:15:36.636soc101win11\Administrator 11241100x80000000000000009357Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:36.673{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveUpdaterService.exe2025-10-29 13:15:36.673soc101win11\Administrator 11241100x80000000000000009358Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:36.737{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5Core.dll2025-10-29 13:15:36.735soc101win11\Administrator 11241100x80000000000000009359Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:36.868{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5DBus.dll2025-10-29 13:15:36.868soc101win11\Administrator 11241100x80000000000000009360Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:36.883{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5Gui.dll2025-10-29 13:15:36.883soc101win11\Administrator 11241100x80000000000000009361Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.000{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5Network.dll2025-10-29 13:15:37.000soc101win11\Administrator 11241100x80000000000000009362Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.026{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5PrintSupport.dll2025-10-29 13:15:37.024soc101win11\Administrator 11241100x80000000000000009363Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.032{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5Qml.dll2025-10-29 13:15:37.032soc101win11\Administrator 11241100x80000000000000009364Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.089{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5QmlModels.dll2025-10-29 13:15:37.089soc101win11\Administrator 11241100x80000000000000009365Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.101{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5QmlWorkerScript.dll2025-10-29 13:15:37.101soc101win11\Administrator 11241100x80000000000000009366Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.105{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5Quick.dll2025-10-29 13:15:37.105soc101win11\Administrator 11241100x80000000000000009367Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.168{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5QuickControls2.dll2025-10-29 13:15:37.166soc101win11\Administrator 11241100x80000000000000009368Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.172{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5QuickTemplates2.dll2025-10-29 13:15:37.172soc101win11\Administrator 11241100x80000000000000009369Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.196{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5Svg.dll2025-10-29 13:15:37.196soc101win11\Administrator 11241100x80000000000000009370Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.204{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5Widgets.dll2025-10-29 13:15:37.204soc101win11\Administrator 11241100x80000000000000009371Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.297{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Qt5WinExtras.dll2025-10-29 13:15:37.297soc101win11\Administrator 11241100x80000000000000009372Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.311{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\ReactNativePicker.dll2025-10-29 13:15:37.311soc101win11\Administrator 11241100x80000000000000009373Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.316{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\RNSVG.dll2025-10-29 13:15:37.316soc101win11\Administrator 11241100x80000000000000009374Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.335{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\SyncEngine.dll2025-10-29 13:15:37.335soc101win11\Administrator 11241100x80000000000000009375Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.537{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\Telemetry.dll2025-10-29 13:15:37.537soc101win11\Administrator 11241100x80000000000000009376Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.584{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\ucrtbase.dll2025-10-29 13:15:37.584soc101win11\Administrator 11241100x80000000000000009377Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.609{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\UpdateRingSettings.dll2025-10-29 13:15:37.609soc101win11\Administrator 11241100x80000000000000009378Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.628{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\vcamp140_app.dll2025-10-29 13:15:37.628soc101win11\Administrator 11241100x80000000000000009379Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.643{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\vccorlib140_app.dll2025-10-29 13:15:37.641soc101win11\Administrator 11241100x80000000000000009380Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.650{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\vcomp140_app.dll2025-10-29 13:15:37.650soc101win11\Administrator 11241100x80000000000000009381Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.656{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\vcruntime140.dll2025-10-29 13:15:37.654soc101win11\Administrator 11241100x80000000000000009382Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.661{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\vcruntime140_1.dll2025-10-29 13:15:37.661soc101win11\Administrator 11241100x80000000000000009383Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.665{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\vcruntime140_1_app.dll2025-10-29 13:15:37.663soc101win11\Administrator 11241100x80000000000000009384Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.667{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\vcruntime140_app.dll2025-10-29 13:15:37.667soc101win11\Administrator 11241100x80000000000000009385Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.672{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\WebView2Loader.dll2025-10-29 13:15:37.672soc101win11\Administrator 11241100x80000000000000009386Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.678{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\WnsClientApi.dll2025-10-29 13:15:37.678soc101win11\Administrator 11241100x80000000000000009387Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:37.695{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\zlib1.dll2025-10-29 13:15:37.695soc101win11\Administrator 11241100x80000000000000009388Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:38.292{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileCoAuthLib.dll2025-10-29 13:15:38.290soc101win11\Administrator 11241100x80000000000000009389Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:38.302{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dll2025-10-29 13:15:38.302soc101win11\Administrator 11241100x80000000000000009390Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:38.354{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\imageformats\qgif.dll2025-10-29 13:15:38.354soc101win11\Administrator 11241100x80000000000000009391Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:38.358{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\imageformats\qjpeg.dll2025-10-29 13:15:38.358soc101win11\Administrator 11241100x80000000000000009392Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:38.369{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\imageformats\qsvg.dll2025-10-29 13:15:38.369soc101win11\Administrator 11241100x80000000000000009393Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:38.371{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\imageformats\qwebp.dll2025-10-29 13:15:38.371soc101win11\Administrator 11241100x80000000000000009394Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:38.385{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\IRMProtectors\microsoft.aip.pdfprotector.dll2025-10-29 13:15:38.385soc101win11\Administrator 11241100x80000000000000009395Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:38.405{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\IRMProtectors\Microsoft.Office.Irm.MsoProtector.dll2025-10-29 13:15:38.403soc101win11\Administrator 11241100x80000000000000009396Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:38.410{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\IRMProtectors\Microsoft.Office.Irm.OfcProtector.dll2025-10-29 13:15:38.408soc101win11\Administrator 11241100x80000000000000009397Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:39.035{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OD4\zlib1.dll2025-10-29 13:15:39.035soc101win11\Administrator 154100x80000000000000009398Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:39.053{8223a6b9-137b-6902-1f01-000000002b00}11500C:\Windows\System32\dmclient.exe10.0.26100.3624 (WinBuild.160101.0800)Microsoft Feedback SIUF Deployment Manager ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationdmclient.exe"C:\WINDOWS\system32\dmclient.exe" utcwnfC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=ADE2D804514A7ADC1793FDE0DB3E2D7B,SHA256=B7E299313494360EA4A147FEAD786939E443850B0910421DA7F1A2F186A37445,IMPHASH=BE4CDFB4F5176337C6B65F6C57146EC5{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 11241100x80000000000000009399Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:39.321{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\platforms\qwindows.dll2025-10-29 13:15:39.321soc101win11\Administrator 11241100x80000000000000009400Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:41.166{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\qml\QtQml\qmlplugin.dll2025-10-29 13:15:41.166soc101win11\Administrator 11241100x80000000000000009401Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:41.180{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\qml\QtQuick.2\qtquick2plugin.dll2025-10-29 13:15:41.178soc101win11\Administrator 11241100x80000000000000009402Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:41.647{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\qml\QtQml\Models.2\modelsplugin.dll2025-10-29 13:15:41.647soc101win11\Administrator 11241100x80000000000000009403Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:41.666{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\qml\QtQuick\Controls\qtquickcontrolsplugin.dll2025-10-29 13:15:41.664soc101win11\Administrator 11241100x80000000000000009404Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:41.709{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\qml\QtQuick\Controls.2\qtquickcontrols2plugin.dll2025-10-29 13:15:41.709soc101win11\Administrator 11241100x80000000000000009405Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:41.725{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\qml\QtQuick\Extras\qtquickextrasplugin.dll2025-10-29 13:15:41.725soc101win11\Administrator 11241100x80000000000000009406Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:41.733{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\qml\QtQuick\Layouts\qquicklayoutsplugin.dll2025-10-29 13:15:41.733soc101win11\Administrator 11241100x80000000000000009407Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:41.743{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\qml\QtQuick\Templates.2\qtquicktemplates2plugin.dll2025-10-29 13:15:41.743soc101win11\Administrator 11241100x80000000000000009408Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:41.755{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\qml\QtQuick\Window.2\windowplugin.dll2025-10-29 13:15:41.755soc101win11\Administrator 11241100x80000000000000009409Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:15:41.928{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\qml\QtQuick\Controls\Styles\Flat\qtquickextrasflatplugin.dll2025-10-29 13:15:41.928soc101win11\Administrator 11241100x80000000000000009410Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:42.852{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveSetup.exe2025-10-29 13:15:42.778soc101win11\Administrator 534500x80000000000000009411Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:43.372{8223a6b9-1358-6902-f600-000000002b00}10944C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administrator 11241100x80000000000000009412Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:43.501{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\{1DDD16BB-AFF5-414D-BCF9-82C00E204A02}_OneDrive.exe2025-10-29 13:15:43.499soc101win11\Administrator 11241100x80000000000000009413Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:43.537{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe2025-09-03 13:55:57.279soc101win11\Administrator 11241100x80000000000000009414Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:43.842{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003\{CBD159C6-2FDA-4627-9908-C11C3A6EA6D0}_OneDriveStandaloneUpdater.exe2025-10-29 13:15:43.842soc101win11\Administrator 11241100x80000000000000009415Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:43.891{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe2025-09-03 13:55:57.802soc101win11\Administrator 11241100x80000000000000009416Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:15:43.927{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe2025-09-03 13:56:23.831soc101win11\Administrator 11241100x80000000000000009417Microsoft-Windows-Sysmon/Operationalsoc101win11T10232025-10-29 13:15:44.052{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk2025-09-03 13:55:58.369soc101win11\Administrator 154100x80000000000000009418Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:44.176{8223a6b9-1380-6902-2401-000000002b00}5048C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncConfig.exe25.189.0928.0002Microsoft OneDrive Configuration ApplicationMicrosoft OneDriveMicrosoft CorporationFileSyncConfig.exe"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncConfig.exe" C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=134C3745881BAFAF920D5D43840691B2,SHA256=6E81822B471E3B65CF2A57E2505738C0226A515E943ABB15CD31450895C31CE2,IMPHASH=762765E8B430012ED5B6FBDC137D2A18{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ReLaunchOD4AppHarness /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepairsoc101win11\Administrator 13241300x80000000000000009419Microsoft-Windows-Sysmon/Operationalsoc101win11InvDBSetValue2025-10-29 13:15:44.199{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncConfig.exeBinary DataNT AUTHORITY\SYSTEM 534500x80000000000000009420Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:44.605{8223a6b9-1380-6902-2401-000000002b00}5048C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncConfig.exesoc101win11\Administrator 13241300x80000000000000009421Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:15:45.094{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\filesyncconfig.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009422Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:15:45.094{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009423Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:15:45.094{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\LinkDate05/17/2076 18:38:07NT AUTHORITY\SYSTEM 13241300x80000000000000009424Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:15:45.094{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x80000000000000009425Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.195{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\OneDrive.CameraRoll.Import\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"odopen://cameraRoll"soc101win11\Administrator 12241200x80000000000000009426Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteValue2025-10-29 13:15:45.232{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\*\shellex\ContextMenuHandlers\ FileSyncExsoc101win11\Administrator 12241200x80000000000000009427Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:15:45.232{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\*\shellex\ContextMenuHandlers\ FileSyncExsoc101win11\Administrator 12241200x80000000000000009428Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteValue2025-10-29 13:15:45.232{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncExsoc101win11\Administrator 12241200x80000000000000009429Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:15:45.232{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncExsoc101win11\Administrator 12241200x80000000000000009430Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteValue2025-10-29 13:15:45.232{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncExsoc101win11\Administrator 12241200x80000000000000009431Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:15:45.232{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncExsoc101win11\Administrator 12241200x80000000000000009432Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteValue2025-10-29 13:15:45.232{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers\ FileSyncExsoc101win11\Administrator 12241200x80000000000000009433Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:15:45.232{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers\ FileSyncExsoc101win11\Administrator 12241200x80000000000000009434Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteValue2025-10-29 13:15:45.232{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncExsoc101win11\Administrator 12241200x80000000000000009435Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:15:45.232{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncExsoc101win11\Administrator 13241300x80000000000000009436Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.292{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009437Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.292{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009438Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.292{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009439Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.292{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009440Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.292{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009441Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.294{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009442Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.294{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009443Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.294{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009444Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.294{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009445Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.294{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009446Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.296{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009447Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.296{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009448Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.298{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009449Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.298{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009450Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.298{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009451Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.298{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009452Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.298{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009453Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.298{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009454Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.300{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009455Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.300{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009456Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.302{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009457Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.302{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009458Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.302{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009459Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.302{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009460Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:45.302{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009461Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:45.302{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009462Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:45.302{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009463Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:45.302{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009464Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:45.304{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009465Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:45.304{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009466Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:45.304{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009467Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:45.304{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009468Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:45.304{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009469Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:45.304{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009470Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.324{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileCoAuthLib.dllsoc101win11\Administrator 13241300x80000000000000009471Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:45.342{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileCoAuthLib64.dllsoc101win11\Administrator 13241300x80000000000000009472Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.353{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\msonedrivesyncserviceclient\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.Sync.Service.exe" /protocol:"%%1"soc101win11\Administrator 13241300x80000000000000009473Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.353{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\msonedrivesyncserviceclient\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.Sync.Service.exe" /protocol:"%%1"soc101win11\Administrator 13241300x80000000000000009474Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.353{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\.fluid\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveFileLauncher.exe" "%%1"soc101win11\Administrator 13241300x80000000000000009475Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.353{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\.note\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveFileLauncher.exe" "%%1"soc101win11\Administrator 13241300x80000000000000009476Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.353{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\.whiteboard\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveFileLauncher.exe" "%%1"soc101win11\Administrator 13241300x80000000000000009477Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.353{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\.loop\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveFileLauncher.exe" "%%1"soc101win11\Administrator 13241300x80000000000000009478Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.353{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\.copilot\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveFileLauncher.exe" "%%1"soc101win11\Administrator 13241300x80000000000000009479Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.353{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\.agent\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDriveFileLauncher.exe" "%%1"soc101win11\Administrator 13241300x80000000000000009480Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.357{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\odopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009481Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.357{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\odopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009482Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.357{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009483Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:45.357{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 11241100x80000000000000009484Microsoft-Windows-Sysmon/Operationalsoc101win11T10232025-10-29 13:15:45.392{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk2025-09-03 13:55:58.369soc101win11\Administrator 13241300x80000000000000009485Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:15:45.400{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\PublisherMicrosoft Corporationsoc101win11\Administrator 13241300x80000000000000009486Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:45.400{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\UrlUpdateInfohttps://go.microsoft.com/fwlink/?LinkID=223554soc101win11\Administrator 11241100x80000000000000009487Microsoft-Windows-Sysmon/Operationalsoc101win11T10532025-10-29 13:15:45.410{8223a6b9-1316-6902-1c00-000000002b00}1588C:\WINDOWS\system32\svchost.exeC:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-4051859043-1187413090-3677023548-5002025-09-03 13:55:58.383NT AUTHORITY\SYSTEM 13241300x80000000000000009488Microsoft-Windows-Sysmon/Operationalsoc101win11T1060,RunKeySetValue2025-10-29 13:15:45.526{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update BinaryC:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"soc101win11\Administrator 13241300x80000000000000009489Microsoft-Windows-Sysmon/Operationalsoc101win11T1060,RunKeySetValue2025-10-29 13:15:45.528{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update BinaryC:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"soc101win11\Administrator 154100x80000000000000009490Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:45.701{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe25.189.0928.0002Microsoft OneDriveMicrosoft OneDriveMicrosoft CorporationOneDrive.exe /updateInstalled /backgroundC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=205D89848B002DB9D818E67BEEFB7FDB,SHA256=A27042CBBFC67B731A4300C60D37CE6510F8ABCF2F449A472003A73436ADC482,IMPHASH=9B64999A42FEBC0CB20DB21F6621FC6F{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ReLaunchOD4AppHarness /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepairsoc101win11\Administrator 154100x80000000000000009491Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:41.257{8223a6b9-137d-6902-2101-000000002b00}8940C:\Users\Administrator\AppData\Local\Ollama\OllamaSetup.exe0.11.11 Ollama Setup Ollama Ollama C:\Users\Administrator\AppData\Local\Ollama\OllamaSetup.exe /CLOSEAPPLICATIONS /LOG=upgrade.log /FORCECLOSEAPPLICATIONS /SP /NOCANCEL /SILENT /VERYSILENT /SUPPRESSMSGBOXESC:\Users\Administrator\AppData\Local\Ollama\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=EF97CE9B7DC3DB673ED0DC4AFF845D2C,SHA256=199347A9170CBA5ECC0B6E2FD0E6ECAD28C9FC0B9512F93185307610839E0B45,IMPHASH=40AB50289F7EF5FAE60801F88D4541FC{8223a6b9-135f-6902-0601-000000002b00}11632C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe" soc101win11\Administrator 534500x80000000000000009492Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:46.308{8223a6b9-135f-6902-0601-000000002b00}11632C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administrator 22542200x80000000000000009493Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:44.795{8223a6b9-1372-6902-1801-000000002b00}12012oneclient.sfx.ms0type: 5 oneclient.sfx.ms.edgesuite.net;type: 5 a124.dscd.akamai.net;::ffff:23.221.212.219;::ffff:23.221.212.215;::ffff:23.221.212.198;::ffff:23.221.212.206;::ffff:23.221.212.207;::ffff:23.221.212.203;::ffff:23.221.212.196;C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exesoc101win11\Administrator 354300x80000000000000009494Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:44.411{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49824-false23.197.210.94-80http 354300x80000000000000009495Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:44.851{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49825-false23.221.212.219-443https 354300x80000000000000009496Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:45.195{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49826-false13.107.213.41-443https 154100x80000000000000009497Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:47.111{8223a6b9-1383-6902-2601-000000002b00}2400C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmp51.1052.0.0Setup/UninstallOllama Ollama "C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmp" /SL5="$3035C,1181414460,796160,C:\Users\Administrator\AppData\Local\Ollama\OllamaSetup.exe" /CLOSEAPPLICATIONS /LOG=upgrade.log /FORCECLOSEAPPLICATIONS /SP /NOCANCEL /SILENT /VERYSILENT /SUPPRESSMSGBOXESC:\Users\Administrator\AppData\Local\Ollama\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=DF0459F3692A4296D71017906796C660,SHA256=FFF9E988F6B6C2A7E45AEFB307F9435771D7C9F24A72EB9B8902CC44717F8E23,IMPHASH=759C48933C0C1DBCBBE95436A5F5C2B6{8223a6b9-137d-6902-2101-000000002b00}8940C:\Users\Administrator\AppData\Local\Ollama\OllamaSetup.exeC:\Users\Administrator\AppData\Local\Ollama\OllamaSetup.exe /CLOSEAPPLICATIONS /LOG=upgrade.log /FORCECLOSEAPPLICATIONS /SP /NOCANCEL /SILENT /VERYSILENT /SUPPRESSMSGBOXESsoc101win11\Administrator 13241300x80000000000000009498Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.150{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009499Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.150{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009500Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.150{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009501Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.150{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009502Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009503Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009504Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009505Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009506Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009507Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009508Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009509Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009510Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009511Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009512Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009513Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.152{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009514Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009515Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009516Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009517Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009518Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009519Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009520Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileSyncShell64.dllsoc101win11\Administrator 13241300x80000000000000009521Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileSyncShell.dllsoc101win11\Administrator 13241300x80000000000000009522Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009523Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009524Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009525Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009526Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009527Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009528Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:47.154{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009529Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:47.156{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009530Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:47.156{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009531Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:15:47.156{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}soc101win11\Administrator 13241300x80000000000000009532Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.162{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\i386\FileCoAuthLib.dllsoc101win11\Administrator 13241300x80000000000000009533Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:15:47.168{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileCoAuthLib64.dllsoc101win11\Administrator 13241300x80000000000000009534Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:47.168{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\odopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009535Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:47.168{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\odopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009536Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:47.168{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009537Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:47.168{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 154100x80000000000000009538Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:47.890{8223a6b9-1383-6902-2701-000000002b00}11124C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileCoAuth.exe25.189.0928.0002Microsoft OneDriveFile Co-Authoring ExecutableMicrosoft OneDriveMicrosoft CorporationFileCoAuth.exe"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileCoAuth.exe" -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=2E043FAFFD4F8931BC1A842F9E4FA32F,SHA256=236A8DB7FD45AC294EF9AA9BAFE1F9FC70ECDB598B27410DE41B9E57A070DE96,IMPHASH=21DEF170CFADB4655DEEFF3322622D63{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 13241300x80000000000000009539Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:48.330{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 13241300x80000000000000009540Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:48.330{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\grvopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1"soc101win11\Administrator 534500x80000000000000009541Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:49.145{8223a6b9-1360-6902-0901-000000002b00}11808C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama.exesoc101win11\Administrator 154100x80000000000000009542Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:49.352{8223a6b9-1385-6902-2801-000000002b00}4888C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.Sync.Service.exe25.189.0928.0002Microsoft OneDrive Sync ServiceMicrosoft OneDrive Sync ServiceMicrosoft CorporationOneDrive.Sync.Service.exe/silentConfigC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=95AD31664C2178A0982E3B9CBF790034,SHA256=E93808788912CF211F052BDA1269404B8464232F8FB2CD02AB87D3F2CA5CF3A1,IMPHASH=DEC74AAC420D912D7A9518BB2BA28F50{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ReLaunchOD4AppHarness /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepairsoc101win11\Administrator 354300x80000000000000009543Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:47.856{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49828-false13.107.213.41-443https 354300x80000000000000009544Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:47.856{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49829-false52.123.129.14-443https 154100x80000000000000009545Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:49.564{8223a6b9-1385-6902-2901-000000002b00}10668C:\Windows\System32\taskkill.exe10.0.26100.1 (WinBuild.160101.0800)Terminates ProcessesMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskkill.exe"taskkill.exe" /f /im "ollama app.exe"C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CBF904BC6835B56A4BD5AC4141F8D131,SHA256=1249717315FC8F4D2DF17D5DB9DA0444795FDB9FB83DFB1F763C3F39282244F7,IMPHASH=FFE513AF7F8477FE56A2B3C63BE2D148{8223a6b9-1383-6902-2601-000000002b00}2400C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmp"C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmp" /SL5="$3035C,1181414460,796160,C:\Users\Administrator\AppData\Local\Ollama\OllamaSetup.exe" /CLOSEAPPLICATIONS /LOG=upgrade.log /FORCECLOSEAPPLICATIONS /SP /NOCANCEL /SILENT /VERYSILENT /SUPPRESSMSGBOXESsoc101win11\Administrator 22542200x80000000000000009546Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:47.766{8223a6b9-1381-6902-2501-000000002b00}9736ecs.office.com0type: 5 ecs.office.trafficmanager.net;type: 5 dual-s-0005-office.config.skype.com;type: 5 ecs-office.s-0005.dual-s-msedge.net;type: 5 s-0005.dual-s-msedge.net;::ffff:52.123.129.14;::ffff:52.123.128.14;C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administrator 13241300x80000000000000009547Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:15:50.367{8223a6b9-1385-6902-2801-000000002b00}4888C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.Sync.Service.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\msonedrivesyncserviceclient\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.Sync.Service.exe" /protocol:"%%1"soc101win11\Administrator 354300x80000000000000009548Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:48.855{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49832-false23.221.212.219a23-221-212-219.deploy.static.akamaitechnologies.com443https 22542200x80000000000000009549Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:48.671{8223a6b9-1381-6902-2501-000000002b00}9736oneclient.sfx.ms0type: 5 oneclient.sfx.ms.edgesuite.net;type: 5 a124.dscd.akamai.net;::ffff:23.221.212.219;::ffff:23.221.212.215;::ffff:23.221.212.198;::ffff:23.221.212.206;::ffff:23.221.212.207;::ffff:23.221.212.203;::ffff:23.221.212.196;C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administrator 13241300x80000000000000009550Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:15:50.642{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollamasetup.exe|3986c48f1e320d4a\LowerCaseLongPathc:\users\administrator\appdata\local\ollama\ollamasetup.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009551Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:15:50.642{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollamasetup.exe|3986c48f1e320d4a\Publisherollama NT AUTHORITY\SYSTEM 13241300x80000000000000009552Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:15:50.642{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollamasetup.exe|3986c48f1e320d4a\LinkDate01/08/2025 15:36:35NT AUTHORITY\SYSTEM 13241300x80000000000000009553Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:15:50.642{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollamasetup.exe|3986c48f1e320d4a\BinProductVersion0.11.11.0NT AUTHORITY\SYSTEM 13241300x80000000000000009554Microsoft-Windows-Sysmon/Operationalsoc101win11T1060,RunKeySetValue2025-10-29 13:15:50.646{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\RunOnce\Uninstall 25.159.0817.0003C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.159.0817.0003"soc101win11\Administrator 534500x80000000000000009555Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:50.659{8223a6b9-1372-6902-1801-000000002b00}12012C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exesoc101win11\Administrator 534500x80000000000000009556Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:50.695{8223a6b9-1371-6902-1501-000000002b00}11832C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exesoc101win11\Administrator 154100x80000000000000009557Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:50.698{8223a6b9-1386-6902-2c01-000000002b00}12220C:\Windows\System32\taskkill.exe10.0.26100.1 (WinBuild.160101.0800)Terminates ProcessesMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskkill.exe"taskkill.exe" /f /im "ollama.exe"C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CBF904BC6835B56A4BD5AC4141F8D131,SHA256=1249717315FC8F4D2DF17D5DB9DA0444795FDB9FB83DFB1F763C3F39282244F7,IMPHASH=FFE513AF7F8477FE56A2B3C63BE2D148{8223a6b9-1383-6902-2601-000000002b00}2400C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmp"C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmp" /SL5="$3035C,1181414460,796160,C:\Users\Administrator\AppData\Local\Ollama\OllamaSetup.exe" /CLOSEAPPLICATIONS /LOG=upgrade.log /FORCECLOSEAPPLICATIONS /SP /NOCANCEL /SILENT /VERYSILENT /SUPPRESSMSGBOXESsoc101win11\Administrator 13241300x80000000000000009558Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:15:50.814{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\onedrive.sync.service.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009559Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:15:50.814{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009560Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:15:50.816{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\LinkDate06/22/2006 02:04:35NT AUTHORITY\SYSTEM 13241300x80000000000000009561Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:15:50.816{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 354300x80000000000000009562Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:15:51.678{8223a6b9-1381-6902-2501-000000002b00}9736C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49833-false20.44.10.122-443https 534500x80000000000000009563Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:54.294{8223a6b9-1383-6902-2701-000000002b00}11124C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\FileCoAuth.exesoc101win11\Administrator 13241300x80000000000000009564Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:15:54.917{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\filecoauth.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009565Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:15:54.917{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009566Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:15:54.917{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\LinkDate10/08/2061 11:05:30NT AUTHORITY\SYSTEM 13241300x80000000000000009567Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:15:54.919{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 22542200x80000000000000009568Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:56.039{8223a6b9-132e-6902-c800-000000002b00}9780oneclient.sfx.ms0type: 5 oneclient.sfx.ms.edgesuite.net;type: 5 a124.dscd.akamai.net;::ffff:23.221.212.206;::ffff:23.221.212.219;::ffff:23.221.212.198;::ffff:23.221.212.215;::ffff:23.221.212.207;::ffff:23.221.212.196;::ffff:23.221.212.203;C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEM 154100x80000000000000009569Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:15:58.324{8223a6b9-138e-6902-2e01-000000002b00}1308C:\Windows\System32\appidpolicyconverter.exe10.0.26100.3037 (WinBuild.160101.0800)AppID Policy Converter TaskMicrosoft® Windows® Operating SystemMicrosoft CorporationAppIDPolicyConverter.exe"C:\WINDOWS\system32\appidpolicyconverter.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=0FFBB4FEACA5ECFE63ABDA89E4590357,SHA256=6DDF58B70300A3AC7A20493C1AB2A728967FB7ACE55C1D1C68A75E4765E46D78,IMPHASH=EE6363D2375CFB1A505C3D494F2EA076{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 11241100x80000000000000009570Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:16:01.974{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8C69434C-3C88-412A-90BA-F12DCD44A1CD}\mpengine.dll2025-10-29 13:16:01.974NT AUTHORITY\SYSTEM 154100x80000000000000009571Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:03.048{8223a6b9-1393-6902-3001-000000002b00}1288C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009572Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:03.101{8223a6b9-1393-6902-3101-000000002b00}6812C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /cC:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1393-6902-3001-000000002b00}1288C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcNT AUTHORITY\SYSTEM 11241100x80000000000000009573Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:16:03.141{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll2024-11-11 18:43:45.708NT AUTHORITY\SYSTEM 154100x80000000000000009574Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:03.224{8223a6b9-1393-6902-3201-000000002b00}11668C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k InvSvcGroup -p -s InventorySvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009575Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:03.309{8223a6b9-1393-6902-3301-000000002b00}11504C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest C:\WINDOWS\SystemTemp\81F39551-C330-2C0D-1FC8-FABDD8A31108.manC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 354300x80000000000000009576Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:16:02.281{8223a6b9-1385-6902-2801-000000002b00}4888C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\25.189.0928.0002\OneDrive.Sync.Service.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49844-false13.107.137.11-443https 154100x80000000000000009577Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:03.796{8223a6b9-1393-6902-3701-000000002b00}10676C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest C:\WINDOWS\SystemTemp\81F39551-C330-2C0D-1FC8-FABDD8A31108.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x80000000000000009578Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:03.893{8223a6b9-1393-6902-3901-000000002b00}10328C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UsoSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009579Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:04.560{8223a6b9-1394-6902-3b01-000000002b00}10424C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe1450.2506.28022.0MoUSO Core Worker ProcessMicrosoft® Windows® Operating SystemMicrosoft CorporationMoUSOCoreWorker.exe"C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespacesC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=E048EE9A14933FFA4A9C9FC7A8A7F83B,SHA256=B4A080E7ABAC28ADCBB172B53060508457C9CEC25BC339F3DFA0A031CD881737,IMPHASH=D3DBFEDBF38C961BD70D128454E64766{8223a6b9-1393-6902-3901-000000002b00}10328C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UsoSvcNT AUTHORITY\SYSTEM 154100x80000000000000009580Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:04.719{8223a6b9-1394-6902-3d01-000000002b00}10252C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k whesvc -p -s whesvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009581Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:05.275{8223a6b9-1395-6902-4101-000000002b00}10320C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvcC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009582Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:06.283{8223a6b9-1396-6902-4301-000000002b00}8120C:\Windows\UUS\Packages\Preview\amd64\MoNotificationUx.exe1450.2506.28022.0Notifications host processMicrosoft® Windows® Operating SystemMicrosoft CorporationMoNotificationUx.exeC:\WINDOWS\uus\packages\preview\AMD64\MoNotificationUx.exe /ClearActiveNotifications /CV mHXMr069HE2xwQwh.1.0.0C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=D97428A8D4622A2B55C29AAF093A4587,SHA256=84913C18E04A4BFD84A0EC98FE5D636607C5A0EC9C320602FC53B45BB06E3C1B,IMPHASH=B582311B9D89BE4D0BBCB08118245AB0{8223a6b9-1394-6902-3b01-000000002b00}10424C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe"C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespacesNT AUTHORITY\SYSTEM 154100x80000000000000009583Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:13.162{8223a6b9-139d-6902-4401-000000002b00}11992C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe140.0.3485.66Microsoft Edge WebView2Microsoft Edge WebView2Microsoft Corporationmsedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5044,i,8414648281922931543,2705281995567965640,524288 --field-trial-handle=1824,i,16309926270948425934,13846169497689979656,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEnhancedTrackingPreventionEnabled,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccC:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1LowMD5=BE9BDE9E62C9312D4CBD457BCBCD7DBB,SHA256=3E69D3BDEEF96EF731F491A27EC5C79A17D038F626AB246801B89486E67A9C55,IMPHASH=9ACEBDFAC77931C2B0DFBBEA2D494BA9{8223a6b9-135b-6902-fe00-000000002b00}5460C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=9528.4564.12231744914887873383 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccsoc101win11\Administrator 13241300x80000000000000009584Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:16:15.208{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpsigstub.exe|bd458e9ca46fdf51\LowerCaseLongPathc:\windows\system32\mpsigstub.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009585Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:16:15.208{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpsigstub.exe|bd458e9ca46fdf51\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009586Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:16:15.208{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpsigstub.exe|bd458e9ca46fdf51\LinkDate03/07/2001 16:32:57NT AUTHORITY\SYSTEM 13241300x80000000000000009587Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:16:15.208{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpsigstub.exe|bd458e9ca46fdf51\BinProductVersion1.1.24010.2001NT AUTHORITY\SYSTEM 13241300x80000000000000009588Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:16:15.285{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\am_delta.exe|9025d818d4db6f5e\LowerCaseLongPathc:\windows\softwaredistribution\download\install\am_delta.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009589Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:16:15.285{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\am_delta.exe|9025d818d4db6f5e\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009590Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:16:15.285{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\am_delta.exe|9025d818d4db6f5e\LinkDate10/29/2025 06:23:25NT AUTHORITY\SYSTEM 13241300x80000000000000009591Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:16:15.285{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\am_delta.exe|9025d818d4db6f5e\BinProductVersion1.439.539.0NT AUTHORITY\SYSTEM 154100x80000000000000009592Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:21.522{8223a6b9-13a5-6902-4601-000000002b00}8824C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe140.0.3485.66Microsoft Edge WebView2Microsoft Edge WebView2Microsoft Corporationmsedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=5072,i,9667693591809035105,5146696851879612825,524288 --field-trial-handle=1824,i,16309926270948425934,13846169497689979656,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEnhancedTrackingPreventionEnabled,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccC:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1LowMD5=BE9BDE9E62C9312D4CBD457BCBCD7DBB,SHA256=3E69D3BDEEF96EF731F491A27EC5C79A17D038F626AB246801B89486E67A9C55,IMPHASH=9ACEBDFAC77931C2B0DFBBEA2D494BA9{8223a6b9-135b-6902-fe00-000000002b00}5460C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=9528.4564.12231744914887873383 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccsoc101win11\Administrator 154100x80000000000000009593Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:34.019{8223a6b9-13b2-6902-4901-000000002b00}3336C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe140.0.3485.66Microsoft Edge WebView2Microsoft Edge WebView2Microsoft Corporationmsedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=5096,i,5245181844892731086,16243305796155401489,524288 --field-trial-handle=1824,i,16309926270948425934,13846169497689979656,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEnhancedTrackingPreventionEnabled,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccC:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1LowMD5=BE9BDE9E62C9312D4CBD457BCBCD7DBB,SHA256=3E69D3BDEEF96EF731F491A27EC5C79A17D038F626AB246801B89486E67A9C55,IMPHASH=9ACEBDFAC77931C2B0DFBBEA2D494BA9{8223a6b9-135b-6902-fe00-000000002b00}5460C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=9528.4564.12231744914887873383 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccsoc101win11\Administrator 154100x80000000000000009594Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:58.993{8223a6b9-13ca-6902-4a01-000000002b00}3408C:\Windows\System32\wermgr.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Problem ReportingMicrosoft® Windows® Operating SystemMicrosoft CorporationWerMgr"C:\WINDOWS\system32\wermgr.exe" -uploadC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=ABE1D752643419A8252520AABF75C29D,SHA256=1707CB793B8F64B65CA5C2FEEB05CB7198349354E9E67ADE0671EEC3647F351B,IMPHASH=2FEAC3143808B4542A16622000CCFCAE{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009595Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:16:58.993{8223a6b9-13ca-6902-4b01-000000002b00}2096C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009596Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:08.158{8223a6b9-13d4-6902-4c01-000000002b00}3160C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe140.0.3485.66Microsoft Edge WebView2Microsoft Edge WebView2Microsoft Corporationmsedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5549 --gpu-device-id=1029 --gpu-sub-system-id=67442093 --gpu-revision=0 --gpu-driver-version=9.17.7.4 --noerrdialogs --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5116,i,15231734165333697324,3853858971374777882,262144 --field-trial-handle=1824,i,16309926270948425934,13846169497689979656,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEnhancedTrackingPreventionEnabled,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:10 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccC:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=BE9BDE9E62C9312D4CBD457BCBCD7DBB,SHA256=3E69D3BDEEF96EF731F491A27EC5C79A17D038F626AB246801B89486E67A9C55,IMPHASH=9ACEBDFAC77931C2B0DFBBEA2D494BA9{8223a6b9-135b-6902-fe00-000000002b00}5460C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WebViewHost.exe --webview-exe-version=19.2509.42011.0 --user-data-dir="C:\Users\Administrator\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=9528.4564.12231744914887873383 /pfhostedapp:e830ad23bfc36491c9d262fefe59af8254ffd0ccsoc101win11\Administrator 11241100x80000000000000009597Microsoft-Windows-Sysmon/Operationalsoc101win11T10232025-10-29 13:17:22.053{8223a6b9-1383-6902-2601-000000002b00}2400C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmpC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ollama\Ollama.lnk2025-09-03 13:59:01.792soc101win11\Administrator 11241100x80000000000000009598Microsoft-Windows-Sysmon/Operationalsoc101win11T10232025-10-29 13:17:22.085{8223a6b9-1383-6902-2601-000000002b00}2400C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmpC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ollama.lnk2025-09-03 13:59:01.821soc101win11\Administrator 13241300x80000000000000009599Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:17:22.100{8223a6b9-1383-6902-2601-000000002b00}2400C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmpHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\ollama\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe" "%%1"soc101win11\Administrator 13241300x80000000000000009600Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:17:22.113{8223a6b9-1383-6902-2601-000000002b00}2400C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmpHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\Uninstall\{44E83376-CE68-45EB-8FC1-393500EB558C}_is1\PublisherOllamasoc101win11\Administrator 13241300x80000000000000009601Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:17:22.113{8223a6b9-1383-6902-2601-000000002b00}2400C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmpHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\Uninstall\{44E83376-CE68-45EB-8FC1-393500EB558C}_is1\URLUpdateInfohttps://ollama.com/soc101win11\Administrator 154100x80000000000000009602Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:22.151{8223a6b9-13e2-6902-4d01-000000002b00}10680C:\Windows\System32\cmd.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"C:\WINDOWS\system32\cmd.exe" /C set PATH=C:\Users\Administrator\AppData\Local\Programs\Ollama;%%PATH%% & "C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=90242B3940D153095204CCA04B83DCF3,SHA256=55D95D29D54112FC203D8B2D6335031FD0EF26C56C9459F239760C24DADD3F24,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{8223a6b9-1383-6902-2601-000000002b00}2400C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmp"C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmp" /SL5="$3035C,1181414460,796160,C:\Users\Administrator\AppData\Local\Ollama\OllamaSetup.exe" /CLOSEAPPLICATIONS /LOG=upgrade.log /FORCECLOSEAPPLICATIONS /SP /NOCANCEL /SILENT /VERYSILENT /SUPPRESSMSGBOXESsoc101win11\Administrator 534500x80000000000000009603Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:22.184{8223a6b9-1383-6902-2601-000000002b00}2400C:\Users\ADMINI~1\AppData\Local\Temp\is-PUA0L.tmp\OllamaSetup.tmpsoc101win11\Administrator 534500x80000000000000009604Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:22.192{8223a6b9-137d-6902-2101-000000002b00}8940C:\Users\Administrator\AppData\Local\Ollama\OllamaSetup.exesoc101win11\Administrator 154100x80000000000000009605Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:23.342{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe-----"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=391155D58E7E4F35803FB28B6DA2BEF0,SHA256=6F05DE8F2C245CCC75DE1849453DE5BB1E9B36E249FA7685F91EFF7176367F26,IMPHASH=381F0D9D17ED9707D58FDC0AC52A26E7{8223a6b9-13e2-6902-4d01-000000002b00}10680C:\Windows\System32\cmd.exe"C:\WINDOWS\system32\cmd.exe" /C set PATH=C:\Users\Administrator\AppData\Local\Programs\Ollama;%PATH% & "C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009606Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:23.582{8223a6b9-13e3-6902-5001-000000002b00}12020C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009607Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:23.914{8223a6b9-13e3-6902-5201-000000002b00}3080C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009608Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:17:23.975{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netsh.exe|9100f7b33e3fe591\LowerCaseLongPathc:\windows\system32\netsh.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009609Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:17:23.975{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netsh.exe|9100f7b33e3fe591\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009610Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:17:23.975{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netsh.exe|9100f7b33e3fe591\LinkDate09/15/2042 12:37:17NT AUTHORITY\SYSTEM 13241300x80000000000000009611Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:17:23.975{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netsh.exe|9100f7b33e3fe591\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 154100x80000000000000009612Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:23.983{8223a6b9-13e3-6902-5301-000000002b00}11112C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009613Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:24.881{8223a6b9-13e4-6902-5501-000000002b00}7020C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama.exe-----C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama.exe serveC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=9793C9EFD0D48CA763F2883A2C2D8C4D,SHA256=A9F9F07C38F90275DE99D3C28B105D7EA18DAD02D024D32D8A919E372363E9EF,IMPHASH=5DAC5D4CADE852AD7594BAB358401F19{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 354300x80000000000000009614Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:17:23.621{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49856-false34.36.133.15-443https 22542200x80000000000000009615Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:23.567{8223a6b9-13e3-6902-4f01-000000002b00}2736ollama.com0::ffff:34.36.133.15;C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administrator 154100x80000000000000009616Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:27.752{8223a6b9-13e7-6902-5801-000000002b00}2756C:\Windows\System32\backgroundTaskHost.exe10.0.26100.1 (WinBuild.160101.0800)Background Task HostMicrosoft® Windows® Operating SystemMicrosoft CorporationbackgroundTaskHost.exe"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXapskvk16gk8da8kch5g4qxh42vxccved.mcaC:\Program Files\WindowsApps\Microsoft.YourPhone_1.25082.136.0_x64__8wekyb3d8bbwe\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=8BDE0AE40012BD639FC60E494CC32356,SHA256=B7D2C17E0038945AA4B72AE7A89E54D29B04CCC0FEB62DF5C9B7B67DE43C2530,IMPHASH=DC601E2593053A84A6989DE251407AA7{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x80000000000000009617Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:28.543{8223a6b9-13e8-6902-5c01-000000002b00}3596C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009618Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:28.667{8223a6b9-13e8-6902-5e01-000000002b00}4288C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009619Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:28.899{8223a6b9-13e8-6902-5f01-000000002b00}6140C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.26.430.0_x64__8wekyb3d8bbwe\WindowsPackageManagerServer.exe-----"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.26.430.0_x64__8wekyb3d8bbwe\WindowsPackageManagerServer.exe" -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=35A23608AAB2B4BB50199885F4ABD944,SHA256=A087F60648C19CB5F7B0B279AE0211208E37158345284E9F99CC798C0F4EBE70,IMPHASH=641FD972DDBA885472113AECA5399D21{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 354300x80000000000000009620Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:17:27.374{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49857-false140.82.113.3-443https 354300x80000000000000009621Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:17:27.738{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49858-false185.199.110.133-443https 22542200x80000000000000009622Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:27.182{8223a6b9-13e3-6902-4f01-000000002b00}2736github.com0::ffff:140.82.113.3;C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administrator 154100x80000000000000009623Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:29.336{8223a6b9-13e9-6902-6001-000000002b00}12172C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25082.136.0_x64__8wekyb3d8bbwe\PhoneExperienceHost.exe1.25082.136.0Microsoft Phone LinkMicrosoft Phone LinkMicrosoft CorporationPhoneExperienceHost.dll"C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25082.136.0_x64__8wekyb3d8bbwe\PhoneExperienceHost.exe" -ComServer:Background -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=2E2A1EA484534ADAA22C79F430D497D2,SHA256=D073F3995A41E8DDD33488E09FBC99FA2238B089E2BA5C873FB17B4F80E426E8,IMPHASH=7A8C872F8E13D32F36A675B52EDA1D6E{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 22542200x80000000000000009624Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:27.695{8223a6b9-13e3-6902-4f01-000000002b00}2736release-assets.githubusercontent.com0::ffff:185.199.110.133;::ffff:185.199.108.133;::ffff:185.199.111.133;::ffff:185.199.109.133;C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administrator 154100x80000000000000009625Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:30.312{8223a6b9-13ea-6902-6101-000000002b00}12156C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009626Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:32.379{8223a6b9-13ec-6902-6201-000000002b00}6384C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -pC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009627Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:33.549{8223a6b9-13ed-6902-6301-000000002b00}7060C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009628Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:33.693{8223a6b9-13ed-6902-6501-000000002b00}8472C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 22542200x80000000000000009629Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:32.944{8223a6b9-13e9-6902-6001-000000002b00}12172default.exp-tas.com0type: 5 deault-exp-tas-com.e-0014.e-msedge.net;type: 5 e-0014.e-msedge.net;::ffff:13.107.5.93;C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25082.136.0_x64__8wekyb3d8bbwe\PhoneExperienceHost.exesoc101win11\Administrator 154100x80000000000000009630Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:38.545{8223a6b9-13f2-6902-6601-000000002b00}3988C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009631Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:38.694{8223a6b9-13f2-6902-6801-000000002b00}3624C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009632Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:43.548{8223a6b9-13f7-6902-6901-000000002b00}8640C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009633Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:43.686{8223a6b9-13f7-6902-6b01-000000002b00}10224C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009634Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:48.544{8223a6b9-13fc-6902-6c01-000000002b00}11644C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009635Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:48.708{8223a6b9-13fc-6902-6e01-000000002b00}11352C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009636Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:53.549{8223a6b9-1401-6902-6f01-000000002b00}11920C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009637Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:53.690{8223a6b9-1401-6902-7101-000000002b00}3548C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009638Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:58.545{8223a6b9-1406-6902-7201-000000002b00}6468C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009639Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:17:58.765{8223a6b9-1406-6902-7401-000000002b00}10744C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009640Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:00.970{8223a6b9-1408-6902-7501-000000002b00}6436C:\Windows\System32\wbem\WMIADAP.exe10.0.26100.3624 (WinBuild.160101.0800)WMI Reverse Performance Adapter Maintenance UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwmicookr.dllwmiadap.exe /F /T /RC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=BB080EF9D3DDFAA656A8C9FB98F11966,SHA256=94B54A00415B3A162F3565CA8A7629358E5F8933C421B7CF24FA5748E956A84F,IMPHASH=FA5718BEB895243416970B6C1C85E7E3{8223a6b9-1318-6902-5200-000000002b00}4036C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s WinmgmtNT AUTHORITY\SYSTEM 13241300x80000000000000009641Microsoft-Windows-Sysmon/Operationalsoc101win11Suspicious,ImageBeginWithBackslashSetValue2025-10-29 13:18:01.027{8223a6b9-1408-6902-7501-000000002b00}6436\\?\C:\WINDOWS\system32\wbem\WMIADAP.EXEHKLM\SOFTWARE\Microsoft\Wbem\PROVIDERS\Performance\Performance RefreshDWORD (0x00000001)NT AUTHORITY\SYSTEM 154100x80000000000000009642Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:03.549{8223a6b9-140b-6902-7601-000000002b00}10644C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009643Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:03.693{8223a6b9-140b-6902-7801-000000002b00}3236C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009644Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:05.603{8223a6b9-140d-6902-7901-000000002b00}11384C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe10.0.27840.1000 (WinBuild.160101.0800)Windows Security Health HostMicrosoft® Windows® Operating SystemMicrosoft CorporationSecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=478FBFDA6A51CF9F0D5BFD50B72DFB08,SHA256=272896B88C6C30DD41E8D44FD54A676FDC6A675BE3F38AAA7434F51B98B822E0,IMPHASH=E8960CAF12CF621B3CA78988264C27F1{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x80000000000000009645Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:08.544{8223a6b9-1410-6902-7a01-000000002b00}8616C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009646Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:08.675{8223a6b9-1410-6902-7c01-000000002b00}10304C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009647Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:13.545{8223a6b9-1415-6902-7d01-000000002b00}5540C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009648Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:13.687{8223a6b9-1415-6902-7f01-000000002b00}11912C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009649Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:18.547{8223a6b9-141a-6902-8001-000000002b00}2084C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009650Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:18.676{8223a6b9-141a-6902-8201-000000002b00}7948C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009651Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:21.019{8223a6b9-141d-6902-8301-000000002b00}2984C:\Windows\System32\Taskmgr.exe10.0.26100.4768 (WinBuild.160101.0800)Task ManagerMicrosoft® Windows® Operating SystemMicrosoft CorporationTaskmgr.exe"C:\WINDOWS\system32\taskmgr.exe" /4C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=B04B647A27204DC3E7889C3D6C8CA0E2,SHA256=AE125A8D361A9B87921762EE3B8AD99E8413D30742D45507FCAE0B72491862E5,IMPHASH=AEB83FC85EAC652029966193AA3B1B20{8223a6b9-1327-6902-af00-000000002b00}7368C:\Windows\explorer.exeC:\WINDOWS\Explorer.EXEsoc101win11\Administrator 154100x80000000000000009652Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:23.546{8223a6b9-141f-6902-8401-000000002b00}10288C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009653Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:23.684{8223a6b9-141f-6902-8601-000000002b00}11536C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009654Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:28.549{8223a6b9-1424-6902-8701-000000002b00}8120C:\Windows\System32\netsh.exe10.0.26100.4768 (WinBuild.160101.0800)Network Command ShellMicrosoft® Windows® Operating SystemMicrosoft Corporationnetsh.exenetsh interface show interfaceC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=C67F4AB9346911DFA97C516925D2E4B1,SHA256=0C7735C2B29FD0799A1091FD22D13563D8835EE00371D076F69CC0FD283DF2A0,IMPHASH=73E5A0DA41255DDE6B0FE666ED3EA9E6{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 154100x80000000000000009655Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:28.679{8223a6b9-1424-6902-8901-000000002b00}11780C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 534500x80000000000000009656Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:30.249{8223a6b9-13e4-6902-5501-000000002b00}7020C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama.exesoc101win11\Administrator 154100x80000000000000009657Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:31.273{8223a6b9-1427-6902-8a01-000000002b00}1096C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama.exe-----C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama.exe serveC:\Windows\System32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=9793C9EFD0D48CA763F2883A2C2D8C4D,SHA256=A9F9F07C38F90275DE99D3C28B105D7EA18DAD02D024D32D8A919E372363E9EF,IMPHASH=5DAC5D4CADE852AD7594BAB358401F19{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exe"soc101win11\Administrator 534500x80000000000000009658Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:32.494{8223a6b9-13e3-6902-4f01-000000002b00}2736C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama app.exesoc101win11\Administrator 534500x80000000000000009659Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:35.949{8223a6b9-1427-6902-8a01-000000002b00}1096C:\Users\Administrator\AppData\Local\Programs\Ollama\ollama.exesoc101win11\Administrator 154100x80000000000000009660Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:43.365{8223a6b9-1433-6902-8c01-000000002b00}6584C:\Program Files\Google\Chrome\Application\chrome.exe131.0.6778.70Google ChromeGoogle ChromeGoogle LLCchrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=967FFF176D86AC8701340B6DB7EAD66B,SHA256=450675F1A9C072DDA4C17A9F2C49CE858AFF4586D7A74FBC19AEB302669FEDC1,IMPHASH=5D59E18B03E66F630296FC0E9CF014A5{8223a6b9-1327-6902-af00-000000002b00}7368C:\Windows\explorer.exeC:\WINDOWS\Explorer.EXEsoc101win11\Administrator 154100x80000000000000009661Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:43.928{8223a6b9-1433-6902-9101-000000002b00}12200C:\Program Files\Google\Chrome\Application\131.0.6778.70\elevation_service.exe131.0.6778.70Google ChromeGoogle ChromeGoogle LLCelevation_service.exe"C:\Program Files\Google\Chrome\Application\131.0.6778.70\elevation_service.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=55A3A2FB1B9C16AFF60DF1426F3548D7,SHA256=D610523029FB075F0C61917F4533908C16C60F581752EA1CCFA8F1510DAF3529,IMPHASH=1627C441EF466468A67FA8850D88302C{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009662Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:48.133{8223a6b9-1438-6902-9a01-000000002b00}724C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 22542200x80000000000000009663Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:51.411{8223a6b9-1433-6902-8f01-000000002b00}6872wpad1460-C:\Program Files\Google\Chrome\Application\chrome.exesoc101win11\Administrator 154100x80000000000000009664Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:18:58.973{8223a6b9-1442-6902-a701-000000002b00}10868C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 11241100x80000000000000009665Microsoft-Windows-Sysmon/Operationalsoc101win11Downloads2025-10-29 13:18:59.229{8223a6b9-1433-6902-8c01-000000002b00}6584C:\Program Files\Google\Chrome\Application\chrome.exeC:\Users\Administrator\Downloads\6a9edbe4-86d2-46b3-9251-38a1d91cde5d.tmp2025-10-29 13:18:59.228soc101win11\Administrator 154100x80000000000000009666Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:19:15.787{8223a6b9-1453-6902-b201-000000002b00}10300C:\Windows\System32\sc.exe10.0.26100.4484 (WinBuild.160101.0800)Service Control Manager Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsc.exe"C:\WINDOWS\system32\sc.exe" start pushtoinstall loginC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=C8F632A326219F85927B3F33A13F7C7D,SHA256=A452BFCB6000D03942DDFADDCDA5A7EB121447ED99B1BA090446B4A989F1F7AE,IMPHASH=42DADBD60BBC453DD1773FDC089E19B7{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009667Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:19:15.789{8223a6b9-1453-6902-b301-000000002b00}1584C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe LogonC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009668Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:19:15.834{8223a6b9-1453-6902-b501-000000002b00}4016C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s PushToInstallC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009669Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:19:30.787{8223a6b9-1327-6902-af00-000000002b00}7368C:\WINDOWS\Explorer.EXEHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefileBinary Datasoc101win11\Administrator 22542200x80000000000000009670Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:20:05.270{8223a6b9-132e-6902-c800-000000002b00}9780storage.googleapis.com0::ffff:142.250.64.155;::ffff:172.217.2.219;::ffff:192.178.50.59;::ffff:172.217.165.219;::ffff:142.250.64.251;::ffff:142.250.64.219;::ffff:142.250.217.219;::ffff:192.178.50.91;::ffff:142.250.217.187;::ffff:142.250.217.251;::ffff:172.217.15.219;::ffff:142.251.34.155;C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEM 154100x80000000000000009671Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:20:10.817{8223a6b9-148a-6902-bc01-000000002b00}7784C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe2.8.431.10Java Update CheckerJava Platform SE Auto UpdaterOracle Corporationjucheck.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -autoC:\WINDOWS\SysWOW64\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=B343088820A96B2363740BD42684A1BF,SHA256=7000911446776DD7782CBDECBF90F3887C849B2A63A25C3964CD85F5A208ADC4,IMPHASH=77DDE1193FCD7DC3EEA722F26FBD15D6{8223a6b9-135e-6902-0501-000000002b00}11608C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" soc101win11\Administrator 154100x80000000000000009672Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:20:11.200{8223a6b9-148b-6902-bd01-000000002b00}2164C:\Program Files (x86)\Java\jre1.8.0_431\bin\javaws.exe11.431.2.10Java(TM) Web Start LauncherJava(TM) Platform SE 8 U431Oracle Corporationjavaws.exe"C:\Program Files (x86)\Java\jre1.8.0_431\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdateC:\WINDOWS\SysWOW64\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=DDC5988EB4B4CC5BEE5921C3D9425325,SHA256=9559835CEF3BEC420CA36E8CC420ED316EECF0E03ACE26C0FD4B94B3ED7C3E0A,IMPHASH=707CEB865C9D276F7F39A10EEFB9CB15{8223a6b9-148a-6902-bc01-000000002b00}7784C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -autosoc101win11\Administrator 154100x80000000000000009673Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:20:11.255{8223a6b9-148b-6902-be01-000000002b00}4544C:\Program Files (x86)\Java\jre1.8.0_431\bin\jp2launcher.exe11.431.2.10Java(TM) Web LauncherJava(TM) Platform SE 8 U431Oracle Corporationjp2launcher.exe"C:\Program Files (x86)\Java\jre1.8.0_431\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_431" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDMxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDMxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQzMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80MzFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQzMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDMxXGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80MzFcYmluXGphdmF3LmV4ZQAtRGpubHB4LnZtYXJncz1MVVJxWkdzdVpHbHpZV0pzWlV4aGMzUlZjMkZuWlZSeVlXTnJhVzVuUFhSeWRXVUE= -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZhC:\WINDOWS\SysWOW64\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=678559C8C576A72A6FC232222FC75E13,SHA256=37F0670C8B6CA4A0CEE949CD8512A5B1ED1452C9E227DFE173204B815CE6C5F8,IMPHASH=361B2A11E26AD96F9AFC34926D02C659{8223a6b9-148b-6902-bd01-000000002b00}2164C:\Program Files (x86)\Java\jre1.8.0_431\bin\javaws.exe"C:\Program Files (x86)\Java\jre1.8.0_431\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdatesoc101win11\Administrator 22542200x80000000000000009674Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:20:11.557{8223a6b9-148a-6902-bc01-000000002b00}7784javadl-esd-secure.oracle.com0type: 5 javadl-esd-secure.oracle.com.edgekey.net;type: 5 e13073.g.akamaiedge.net;::ffff:23.205.134.132;C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exesoc101win11\Administrator 154100x80000000000000009675Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:20:15.347{8223a6b9-148f-6902-bf01-000000002b00}3956C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource schedulerC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 22542200x80000000000000009676Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:20:18.718{8223a6b9-148b-6902-be01-000000002b00}4544wpad1460-C:\Program Files (x86)\Java\jre1.8.0_431\bin\jp2launcher.exesoc101win11\Administrator 22542200x80000000000000009677Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:20:19.371{8223a6b9-148b-6902-be01-000000002b00}4544javadl-esd-secure.oracle.com0type: 5 javadl-esd-secure.oracle.com.edgekey.net;type: 5 e13073.g.akamaiedge.net;::ffff:23.205.134.132;C:\Program Files (x86)\Java\jre1.8.0_431\bin\jp2launcher.exesoc101win11\Administrator 11241100x80000000000000009678Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:20:39.243{8223a6b9-148b-6902-be01-000000002b00}4544C:\Program Files (x86)\Java\jre1.8.0_431\bin\jp2launcher.exeC:\Users\Administrator\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar2025-09-03 14:01:12.109soc101win11\Administrator 154100x80000000000000009679Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:20:51.271{8223a6b9-14b3-6902-c501-000000002b00}3340C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009680Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:20:55.404{8223a6b9-14b7-6902-ca01-000000002b00}11824C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 11241100x80000000000000009681Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:07.178{8223a6b9-14b3-6902-c501-000000002b00}3340C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeC:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\141.0.3537.99\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe2025-10-29 13:21:07.178NT AUTHORITY\SYSTEM 154100x80000000000000009682Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:10.197{8223a6b9-14c6-6902-cb01-000000002b00}11296C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationmini_installer.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stableC:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=CBC4497AC4C23457F0CAC7642579B4ED,SHA256=4A9BF0D8F69259F18CB0AD75F8EB8849FDD190CB313CDD95165831A3E1956D7E,IMPHASH=BDE7ED863CD6A372CFC7499C55606DDC{8223a6b9-14b3-6902-c501-000000002b00}3340C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcNT AUTHORITY\SYSTEM 11241100x80000000000000009683Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:10.387{8223a6b9-14c6-6902-cb01-000000002b00}11296C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exeC:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe2025-10-29 13:21:10.387NT AUTHORITY\SYSTEM 154100x80000000000000009684Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:10.581{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --previous-version="140.0.3485.66" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stableC:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14c6-6902-cb01-000000002b00}11296C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stableNT AUTHORITY\SYSTEM 154100x80000000000000009685Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:10.656{8223a6b9-14c6-6902-cd01-000000002b00}10572C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=141.0.7390.123 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=141.0.3537.99 --initial-client-data=0x248,0x24c,0x250,0x1ec,0x254,0x7ff729c29568,0x7ff729c29574,0x7ff729c29580C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --previous-version="140.0.3485.66" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stableNT AUTHORITY\SYSTEM 13241300x80000000000000009686Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:21:11.229{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|bf58d33825109b07\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\install\{804b9088-ea66-45b6-bf36-ddb8dcb34152}\microsoftedge_x64_141.0.3537.99_140.0.3485.66.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009687Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:21:11.229{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|bf58d33825109b07\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009688Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:21:11.229{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|bf58d33825109b07\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009689Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:21:11.229{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|bf58d33825109b07\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009690Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:21:11.258{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|6e997736d5f9844b\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\install\{804b9088-ea66-45b6-bf36-ddb8dcb34152}\edgemitmp_b15d0.tmp\setup.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009691Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:21:11.258{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|6e997736d5f9844b\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009692Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:21:11.258{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|6e997736d5f9844b\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009693Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:21:11.258{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|6e997736d5f9844b\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 11241100x80000000000000009694Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:29.785{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\BHO\ie_to_edge_bho.dll2025-10-29 13:21:29.785NT AUTHORITY\SYSTEM 11241100x80000000000000009695Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:29.791{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\BHO\ie_to_edge_bho_64.dll2025-10-29 13:21:29.791NT AUTHORITY\SYSTEM 11241100x80000000000000009696Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:29.813{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\BHO\ie_to_edge_stub.exe2025-10-29 13:21:29.811NT AUTHORITY\SYSTEM 11241100x80000000000000009697Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:29.824{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\concrt140.dll2025-10-29 13:21:29.824NT AUTHORITY\SYSTEM 11241100x80000000000000009698Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:29.838{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\cookie_exporter.exe2025-10-29 13:21:29.838NT AUTHORITY\SYSTEM 11241100x80000000000000009699Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:29.848{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\d3dcompiler_47.dll2025-10-29 13:21:29.848NT AUTHORITY\SYSTEM 11241100x80000000000000009700Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:29.905{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\dual_engine_adapter_x64.dll2025-10-29 13:21:29.905NT AUTHORITY\SYSTEM 11241100x80000000000000009701Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:29.934{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\dxcompiler.dll2025-10-29 13:21:29.934NT AUTHORITY\SYSTEM 11241100x80000000000000009702Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:30.116{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\dxil.dll2025-10-29 13:21:30.116NT AUTHORITY\SYSTEM 11241100x80000000000000009703Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:30.148{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\EBWebView\x64\EmbeddedBrowserWebView.dll2025-10-29 13:21:30.148NT AUTHORITY\SYSTEM 11241100x80000000000000009704Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:30.196{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\EBWebView\x86\EmbeddedBrowserWebView.dll2025-10-29 13:21:30.196NT AUTHORITY\SYSTEM 11241100x80000000000000009705Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:30.243{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\elevated_tracing_service.exe2025-10-29 13:21:30.243NT AUTHORITY\SYSTEM 11241100x80000000000000009706Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:30.296{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\elevation_service.exe2025-10-29 13:21:30.296NT AUTHORITY\SYSTEM 11241100x80000000000000009707Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:30.322{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\eventlog_provider.dll2025-10-29 13:21:30.322NT AUTHORITY\SYSTEM 11241100x80000000000000009708Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:30.322{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\ffmpeg.dll2025-10-29 13:21:30.322NT AUTHORITY\SYSTEM 11241100x80000000000000009709Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:30.417{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\identity_helper.exe2025-10-29 13:21:30.417NT AUTHORITY\SYSTEM 11241100x80000000000000009710Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:30.480{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\learning_tools.dll2025-10-29 13:21:30.480NT AUTHORITY\SYSTEM 11241100x80000000000000009711Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:30.496{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\libEGL.dll2025-10-29 13:21:30.496NT AUTHORITY\SYSTEM 11241100x80000000000000009712Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:30.516{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\libGLESv2.dll2025-10-29 13:21:30.516NT AUTHORITY\SYSTEM 11241100x80000000000000009713Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:31.506{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\microsoft_shell_integration.dll2025-10-29 13:21:31.506NT AUTHORITY\SYSTEM 11241100x80000000000000009714Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:31.521{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\mip_core.dll2025-10-29 13:21:31.521NT AUTHORITY\SYSTEM 11241100x80000000000000009715Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:31.582{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\mip_core_gn.dll2025-10-29 13:21:31.582NT AUTHORITY\SYSTEM 11241100x80000000000000009716Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:31.681{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\mip_protection_sdk.dll2025-10-29 13:21:31.681NT AUTHORITY\SYSTEM 11241100x80000000000000009717Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:31.709{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\msedge.dll2025-10-29 13:21:31.709NT AUTHORITY\SYSTEM 11241100x80000000000000009718Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:36.670{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\msedge.exe2025-10-29 13:21:36.670NT AUTHORITY\SYSTEM 11241100x80000000000000009719Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:36.712{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\msedgewebview2.exe2025-10-29 13:21:36.712NT AUTHORITY\SYSTEM 11241100x80000000000000009720Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:36.775{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\msedge_elf.dll2025-10-29 13:21:36.775NT AUTHORITY\SYSTEM 11241100x80000000000000009721Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:36.807{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\msedge_proxy.exe2025-10-29 13:21:36.807NT AUTHORITY\SYSTEM 11241100x80000000000000009722Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:36.839{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\msedge_pwa_launcher.exe2025-10-29 13:21:36.839NT AUTHORITY\SYSTEM 11241100x80000000000000009723Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:36.855{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\msedge_wer.dll2025-10-29 13:21:36.855NT AUTHORITY\SYSTEM 11241100x80000000000000009724Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:36.871{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\mspdf.dll2025-10-29 13:21:36.871NT AUTHORITY\SYSTEM 11241100x80000000000000009725Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.029{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\msvcp140.dll2025-10-29 13:21:37.029NT AUTHORITY\SYSTEM 11241100x80000000000000009726Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.045{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\msvcp140_codecvt_ids.dll2025-10-29 13:21:37.045NT AUTHORITY\SYSTEM 11241100x80000000000000009727Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:37.053{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\notification_helper.exe2025-10-29 13:21:37.053NT AUTHORITY\SYSTEM 11241100x80000000000000009728Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.079{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\oneauth.dll2025-10-29 13:21:37.077NT AUTHORITY\SYSTEM 11241100x80000000000000009729Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.124{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\oneds.dll2025-10-29 13:21:37.124NT AUTHORITY\SYSTEM 11241100x80000000000000009730Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.181{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\onnxruntime.dll2025-10-29 13:21:37.164NT AUTHORITY\SYSTEM 11241100x80000000000000009731Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.213{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\onramp.dll2025-10-29 13:21:37.213NT AUTHORITY\SYSTEM 11241100x80000000000000009732Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.229{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\PdfPreview\PdfPreviewHandler.dll2025-10-29 13:21:37.229NT AUTHORITY\SYSTEM 11241100x80000000000000009733Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.235{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\prefs_enclave_x64.dll2025-10-29 13:21:37.235NT AUTHORITY\SYSTEM 11241100x80000000000000009734Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:37.245{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\pwahelper.exe2025-10-29 13:21:37.245NT AUTHORITY\SYSTEM 11241100x80000000000000009735Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:37.484{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\show_third_party_software_licenses.bat2025-10-29 13:21:37.484NT AUTHORITY\SYSTEM 11241100x80000000000000009736Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.484{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\telclient.dll2025-10-29 13:21:37.484NT AUTHORITY\SYSTEM 11241100x80000000000000009737Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.562{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\vccorlib140.dll2025-10-29 13:21:37.562NT AUTHORITY\SYSTEM 11241100x80000000000000009738Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.578{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\vcruntime140.dll2025-10-29 13:21:37.578NT AUTHORITY\SYSTEM 11241100x80000000000000009739Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.594{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\vcruntime140_1.dll2025-10-29 13:21:37.594NT AUTHORITY\SYSTEM 11241100x80000000000000009740Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.626{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\vk_swiftshader.dll2025-10-29 13:21:37.626NT AUTHORITY\SYSTEM 11241100x80000000000000009741Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.693{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\vulkan-1.dll2025-10-29 13:21:37.693NT AUTHORITY\SYSTEM 11241100x80000000000000009742Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.705{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\wdag.dll2025-10-29 13:21:37.705NT AUTHORITY\SYSTEM 11241100x80000000000000009743Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.721{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\webview2_integration.dll2025-10-29 13:21:37.721NT AUTHORITY\SYSTEM 11241100x80000000000000009744Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.721{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll2025-10-29 13:21:37.721NT AUTHORITY\SYSTEM 11241100x80000000000000009745Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:21:37.946{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\wns_push_client.dll2025-10-29 13:21:37.946NT AUTHORITY\SYSTEM 11241100x80000000000000009746Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:37.958{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\EdgeCore\141.0.3537.99\Installer\setup.exe2025-10-29 13:21:37.958NT AUTHORITY\SYSTEM 11241100x80000000000000009747Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:38.274{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe2024-03-25 22:24:27.213NT AUTHORITY\SYSTEM 13241300x80000000000000009748Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:21:38.441{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge\PublisherMicrosoft CorporationNT AUTHORITY\SYSTEM 13241300x80000000000000009749Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:21:38.590{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\MicrosoftEdgeElevationService\ImagePath"C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\elevation_service.exe"NT AUTHORITY\SYSTEM 13241300x80000000000000009750Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:21:38.606{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\BHO\ie_to_edge_bho_64.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009751Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:21:38.606{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\BHO\ie_to_edge_bho.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009752Microsoft-Windows-Sysmon/Operationalsoc101win11T1176SetValue2025-10-29 13:21:38.622{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\(Default)IEToEdge BHONT AUTHORITY\SYSTEM 13241300x80000000000000009753Microsoft-Windows-Sysmon/Operationalsoc101win11T1176SetValue2025-10-29 13:21:38.622{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\(Default)IEToEdge BHONT AUTHORITY\SYSTEM 13241300x80000000000000009754Microsoft-Windows-Sysmon/Operationalsoc101win11T1176SetValue2025-10-29 13:21:38.622{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer1NT AUTHORITY\SYSTEM 13241300x80000000000000009755Microsoft-Windows-Sysmon/Operationalsoc101win11T1176SetValue2025-10-29 13:21:38.622{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer1NT AUTHORITY\SYSTEM 13241300x80000000000000009756Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:21:38.622{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\(Default)C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\PdfPreview\PdfPreviewHandler.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009757Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:21:38.622{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\(Default)C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\PdfPreview\PdfPreviewHandler.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009758Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:21:38.642{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32\(Default)C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\EBWebView\x64\EmbeddedBrowserWebView.dllNT AUTHORITY\SYSTEM 13241300x80000000000000009759Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:21:38.642{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\http\shell\open\command\(Default)"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "%%1"NT AUTHORITY\SYSTEM 13241300x80000000000000009760Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:21:38.642{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\https\shell\open\command\(Default)"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "%%1"NT AUTHORITY\SYSTEM 11241100x80000000000000009761Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:38.654{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe2024-03-25 22:24:27.213NT AUTHORITY\SYSTEM 11241100x80000000000000009762Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:38.670{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe2024-03-25 22:24:27.213NT AUTHORITY\SYSTEM 154100x80000000000000009763Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:38.737{8223a6b9-14e2-6902-ce01-000000002b00}11536C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --previous-version="140.0.3485.66" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stableNT AUTHORITY\SYSTEM 154100x80000000000000009764Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:38.773{8223a6b9-14e2-6902-cf01-000000002b00}10876C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=141.0.7390.123 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=141.0.3537.99 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff729c29568,0x7ff729c29574,0x7ff729c29580C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14e2-6902-ce01-000000002b00}11536C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1NT AUTHORITY\SYSTEM 11241100x80000000000000009765Microsoft-Windows-Sysmon/Operationalsoc101win11T10232025-10-29 13:21:38.953{8223a6b9-14e2-6902-ce01-000000002b00}11536C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk2024-11-11 18:43:55.121NT AUTHORITY\SYSTEM 13241300x80000000000000009766Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:21:38.969{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\microsoft-edge\shell\open\command\(Default)"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "%%1"NT AUTHORITY\SYSTEM 13241300x80000000000000009767Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:21:38.969{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\MSEdgeHTM\shell\open\command\(Default)"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument %%1NT AUTHORITY\SYSTEM 13241300x80000000000000009768Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:21:38.969{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\MSEdgeHTM\shell\runas\command\(Default)"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --do-not-de-elevate --single-argument %%1NT AUTHORITY\SYSTEM 13241300x80000000000000009769Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:21:38.969{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\MSEdgePDF\shell\open\command\(Default)"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument %%1NT AUTHORITY\SYSTEM 13241300x80000000000000009770Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:21:38.969{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\MSEdgePDF\shell\runas\command\(Default)"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --do-not-de-elevate --single-argument %%1NT AUTHORITY\SYSTEM 13241300x80000000000000009771Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:21:38.985{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\MSEdgeMHT\shell\open\command\(Default)"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument %%1NT AUTHORITY\SYSTEM 13241300x80000000000000009772Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:21:38.985{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKCR\MSEdgeMHT\shell\runas\command\(Default)"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --do-not-de-elevate --single-argument %%1NT AUTHORITY\SYSTEM 13241300x80000000000000009773Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:21:38.985{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe\(Default)C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009774Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:21:38.985{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe\PathC:\Program Files (x86)\Microsoft\Edge\ApplicationNT AUTHORITY\SYSTEM 13241300x80000000000000009775Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:21:38.985{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe\SupportedProtocols\http(Empty)NT AUTHORITY\SYSTEM 13241300x80000000000000009776Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:21:38.985{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe\SupportedProtocols\https(Empty)NT AUTHORITY\SYSTEM 13241300x80000000000000009777Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:21:39.000{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exeHKLM\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\shell\open\command\(Default)"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"NT AUTHORITY\SYSTEM 154100x80000000000000009778Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:39.084{8223a6b9-14e3-6902-d001-000000002b00}7220C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-levelC:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --previous-version="140.0.3485.66" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stableNT AUTHORITY\SYSTEM 154100x80000000000000009779Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:39.122{8223a6b9-14e3-6902-d101-000000002b00}6936C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-levelC:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14c6-6902-cc01-000000002b00}2596C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\EDGEMITMP_B15D0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804B9088-EA66-45B6-BF36-DDB8DCB34152}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --previous-version="140.0.3485.66" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stableNT AUTHORITY\SYSTEM 154100x80000000000000009780Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:39.147{8223a6b9-14e3-6902-d201-000000002b00}6908C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=141.0.7390.123 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=141.0.3537.99 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff741ec9568,0x7ff741ec9574,0x7ff741ec9580C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14e3-6902-d001-000000002b00}7220C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-levelNT AUTHORITY\SYSTEM 154100x80000000000000009781Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:39.158{8223a6b9-14e3-6902-d301-000000002b00}6784C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=141.0.7390.123 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=141.0.3537.99 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff741ec9568,0x7ff741ec9574,0x7ff741ec9580C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14e3-6902-d101-000000002b00}6936C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.99\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-levelNT AUTHORITY\SYSTEM 13241300x80000000000000009782Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:21:39.380{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\installer\setup.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009783Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:21:39.380{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009784Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:21:39.380{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009785Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:21:39.380{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 154100x80000000000000009786Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.083{8223a6b9-14ef-6902-d601-000000002b00}6304C:\Windows\System32\wermgr.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Problem ReportingMicrosoft® Windows® Operating SystemMicrosoft CorporationWerMgr"C:\WINDOWS\system32\wermgr.exe" -uploadC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=ABE1D752643419A8252520AABF75C29D,SHA256=1707CB793B8F64B65CA5C2FEEB05CB7198349354E9E67ADE0671EEC3647F351B,IMPHASH=2FEAC3143808B4542A16622000CCFCAE{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009787Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.084{8223a6b9-14ef-6902-d701-000000002b00}9368C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe $(Arg0)C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009788Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.093{8223a6b9-14ef-6902-d801-000000002b00}4856C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009789Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.097{8223a6b9-14ef-6902-d901-000000002b00}852C:\Windows\System32\sc.exe10.0.26100.4484 (WinBuild.160101.0800)Service Control Manager Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsc.exe"C:\WINDOWS\system32\sc.exe" start pushtoinstall registrationC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=C8F632A326219F85927B3F33A13F7C7D,SHA256=A452BFCB6000D03942DDFADDCDA5A7EB121447ED99B1BA090446B4A989F1F7AE,IMPHASH=42DADBD60BBC453DD1773FDC089E19B7{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009790Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.103{8223a6b9-14ef-6902-db01-000000002b00}4824C:\Windows\System32\sc.exe10.0.26100.4484 (WinBuild.160101.0800)Service Control Manager Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsc.exe"C:\WINDOWS\system32\sc.exe" start InventorySvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=C8F632A326219F85927B3F33A13F7C7D,SHA256=A452BFCB6000D03942DDFADDCDA5A7EB121447ED99B1BA090446B4A989F1F7AE,IMPHASH=42DADBD60BBC453DD1773FDC089E19B7{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009791Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.103{8223a6b9-14ef-6902-da01-000000002b00}9904C:\Windows\System32\DeviceCensus.exe10.0.26100.4768 (WinBuild.160101.0800)Device CensusMicrosoft® Windows® Operating SystemMicrosoft CorporationDeviceCensus.exe"C:\WINDOWS\system32\devicecensus.exe" SystemCxtC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=0373A144FE33787D388AD09696BF68C1,SHA256=7D39743380748C8CFB61F5C5227DBEF1BD14145AE49A51A7DB225BC4BB4FD4C6,IMPHASH=5505B520B281F5304AC8726CB6621184{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009792Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.115{8223a6b9-14ef-6902-dc01-000000002b00}6076C:\Windows\System32\UIEOrchestrator.exe-----"C:\WINDOWS\system32\UIEOrchestrator.exe" /SendHeartbeatC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=67EC4745AE66DB0F157BFFDF4DBED3EF,SHA256=0AC38DD6AC47808487B401BC87FA984AADDF558AC9118E9290C6A2A81C560EA8,IMPHASH=74AB2C7F85AC6BE882524A9D7D8063E9{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009793Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.117{8223a6b9-14ef-6902-dd01-000000002b00}6664C:\Windows\System32\rundll32.exe10.0.26100.4202 (WinBuild.160101.0800)Windows host process (Rundll32)Microsoft® Windows® Operating SystemMicrosoft CorporationRUNDLL32.EXE"C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\PcaSvc.dll,PcaPatchSdbTaskC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=0257F12B35D1FECB1614585D821346B7,SHA256=7FF8A874903C06C2981F16EF26D1FA2A77B337849A601F6FE4B687FBB0FC15E8,IMPHASH=3DB48F7E208E17408E177BD8B816560A{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009794Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.117{8223a6b9-14ef-6902-de01-000000002b00}2668C:\Windows\System32\wsqmcons.exe10.0.26100.1 (WinBuild.160101.0800)Windows SQM ConsolidatorMicrosoft® Windows® Operating SystemMicrosoft Corporationwsqmcons.exe"C:\WINDOWS\System32\wsqmcons.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=E9D0427623E1DB95EEF5E9B30A2FD4D0,SHA256=76606F2540E958D1D4344A02EC9118D071CA3B62EDD8FC9FE0DC37EC15C70237,IMPHASH=BADE18FFC00BB7673C1A50C3D391F052{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009795Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.131{8223a6b9-14ef-6902-e001-000000002b00}7080C:\Windows\System32\UsoClient.exe10.0.26100.3037 (WinBuild.160101.0800)UsoClientMicrosoft® Windows® Operating SystemMicrosoft CorporationUsoClient"C:\WINDOWS\system32\usoclient.exe" StartScanC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=0AFB6EB9D41AF833D65448734C47A4C2,SHA256=0A4C60CD2FBE6859B6C09F56C7051580F9582F106D1851750264733194B94DB3,IMPHASH=1BC6441172601AD7E84C0082681FF7D2{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009796Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.205{8223a6b9-14ef-6902-e101-000000002b00}7732C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009797Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.292{8223a6b9-14ef-6902-e301-000000002b00}11584C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe25.189.0928.0002Standalone UpdaterMicrosoft OneDriveMicrosoft CorporationOneDriveStandaloneUpdater.exe"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe" /reportingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=5E7499E58A3D2A15A08EFD8D4A5F8597,SHA256=378685419E4124BE02F4277A0B31EF638B5038C5471136B865CA745CF9424DC3,IMPHASH=3BF487005E1B1E1DE4C8941898CAE521{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009798Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.568{8223a6b9-14ef-6902-e501-000000002b00}11376C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe1450.2506.28022.0MoUSO Core Worker ProcessMicrosoft® Windows® Operating SystemMicrosoft CorporationMoUSOCoreWorker.exe"C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespacesC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=E048EE9A14933FFA4A9C9FC7A8A7F83B,SHA256=B4A080E7ABAC28ADCBB172B53060508457C9CEC25BC339F3DFA0A031CD881737,IMPHASH=D3DBFEDBF38C961BD70D128454E64766{8223a6b9-1393-6902-3901-000000002b00}10328C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UsoSvcNT AUTHORITY\SYSTEM 154100x80000000000000009799Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.641{8223a6b9-14ef-6902-e601-000000002b00}892C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s PushToInstallC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009800Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:21:51.726{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wsqmcons.exe|dfcf1aefa7b90250\LowerCaseLongPathc:\windows\system32\wsqmcons.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009801Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:21:51.726{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wsqmcons.exe|dfcf1aefa7b90250\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009802Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:21:51.726{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wsqmcons.exe|dfcf1aefa7b90250\LinkDate09/25/2105 01:21:24NT AUTHORITY\SYSTEM 13241300x80000000000000009803Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:21:51.726{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wsqmcons.exe|dfcf1aefa7b90250\BinProductVersion10.0.26100.1NT AUTHORITY\SYSTEM 154100x80000000000000009804Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:52.124{8223a6b9-14f0-6902-e901-000000002b00}3352C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k WbioSvcGroup -s WbioSrvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 22542200x80000000000000009805Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:52.096{8223a6b9-132e-6902-c800-000000002b00}9780oneclient.sfx.ms0type: 5 oneclient.sfx.ms.edgesuite.net;type: 5 a124.dscd.akamai.net;::ffff:23.221.212.203;::ffff:23.221.212.196;::ffff:23.221.212.202;::ffff:23.221.212.214;::ffff:23.221.212.218;C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEM 354300x80000000000000009806Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:51.730{8223a6b9-14ef-6902-dd01-000000002b00}6664C:\Windows\System32\rundll32.exeNT AUTHORITY\SYSTEMtcptruefalse172.16.143.133soc101win11.localdomain49943-false20.49.150.241-443https 22542200x80000000000000009807Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:52.886{8223a6b9-14ef-6902-e301-000000002b00}11584ecs.office.com0type: 5 ecs.office.trafficmanager.net;type: 5 dual-s-0005-office.config.skype.com;type: 5 ecs-office.s-0005.dual-s-msedge.net;type: 5 s-0005.dual-s-msedge.net;::ffff:52.123.129.14;::ffff:52.123.128.14;C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exesoc101win11\Administrator 354300x80000000000000009808Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:21:52.969{8223a6b9-14ef-6902-e301-000000002b00}11584C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain49949-false52.123.129.14-443https 11241100x80000000000000009809Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:56.423{8223a6b9-14b3-6902-c501-000000002b00}3340C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeC:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\141.0.3537.99\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe2025-10-29 13:21:56.423NT AUTHORITY\SYSTEM 154100x80000000000000009810Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:58.053{8223a6b9-14f6-6902-ec01-000000002b00}4436C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationmini_installer.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-levelC:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=CBC4497AC4C23457F0CAC7642579B4ED,SHA256=4A9BF0D8F69259F18CB0AD75F8EB8849FDD190CB313CDD95165831A3E1956D7E,IMPHASH=BDE7ED863CD6A372CFC7499C55606DDC{8223a6b9-14b3-6902-c501-000000002b00}3340C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcNT AUTHORITY\SYSTEM 11241100x80000000000000009811Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:21:58.241{8223a6b9-14f6-6902-ec01-000000002b00}4436C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exeC:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\EDGEMITMP_FDA10.tmp\setup.exe2025-10-29 13:21:58.241NT AUTHORITY\SYSTEM 154100x80000000000000009812Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:58.413{8223a6b9-14f6-6902-ed01-000000002b00}3904C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\EDGEMITMP_FDA10.tmp\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\EDGEMITMP_FDA10.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --previous-version="140.0.3485.66" --msedgewebview --verbose-logging --do-not-launch-msedge --system-levelC:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14f6-6902-ec01-000000002b00}4436C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-levelNT AUTHORITY\SYSTEM 154100x80000000000000009813Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:21:58.485{8223a6b9-14f6-6902-ee01-000000002b00}2104C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\EDGEMITMP_FDA10.tmp\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\EDGEMITMP_FDA10.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=141.0.7390.123 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\EDGEMITMP_FDA10.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=141.0.3537.99 --initial-client-data=0x24c,0x250,0x254,0x248,0x258,0x7ff778e09568,0x7ff778e09574,0x7ff778e09580C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14f6-6902-ed01-000000002b00}3904C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\EDGEMITMP_FDA10.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\EDGEMITMP_FDA10.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --previous-version="140.0.3485.66" --msedgewebview --verbose-logging --do-not-launch-msedge --system-levelNT AUTHORITY\SYSTEM 13241300x80000000000000009814Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:21:59.114{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|2d57eb15df6c75a3\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\install\{60e5867b-1f8b-4608-949f-e4d05153d38e}\microsoftedge_x64_141.0.3537.99_140.0.3485.66.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009815Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:21:59.114{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|2d57eb15df6c75a3\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009816Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:21:59.114{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|2d57eb15df6c75a3\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009817Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:21:59.114{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|2d57eb15df6c75a3\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009818Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:21:59.288{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|7c59c64e011a51a3\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\install\{60e5867b-1f8b-4608-949f-e4d05153d38e}\edgemitmp_fda10.tmp\setup.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009819Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:21:59.288{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|7c59c64e011a51a3\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009820Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:21:59.288{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|7c59c64e011a51a3\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009821Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:21:59.288{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|7c59c64e011a51a3\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009822Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:22:00.222{8223a6b9-14f6-6902-ed01-000000002b00}3904C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\EDGEMITMP_FDA10.tmp\setup.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView\PublisherMicrosoft CorporationNT AUTHORITY\SYSTEM 154100x80000000000000009823Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:22:00.240{8223a6b9-14f8-6902-ef01-000000002b00}8788C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.99\Installer\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.99\Installer\setup.exe" --msedgewebview --delete-old-versions --system-level --verbose-loggingC:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.99\Installer\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14f6-6902-ed01-000000002b00}3904C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\EDGEMITMP_FDA10.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\EDGEMITMP_FDA10.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60E5867B-1F8B-4608-949F-E4D05153D38E}\MicrosoftEdge_X64_141.0.3537.99_140.0.3485.66.exe" --previous-version="140.0.3485.66" --msedgewebview --verbose-logging --do-not-launch-msedge --system-levelNT AUTHORITY\SYSTEM 154100x80000000000000009824Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:22:00.313{8223a6b9-14f8-6902-f001-000000002b00}8772C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.99\Installer\setup.exe141.0.3537.99Microsoft Edge InstallerMicrosoft Edge InstallerMicrosoft Corporationsetup.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.99\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=141.0.7390.123 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.99\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=141.0.3537.99 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff741ec9568,0x7ff741ec9574,0x7ff741ec9580C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.99\Installer\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=52A06F23215B48AF5CD33AA047609E71,SHA256=02AA85837EBBFF67329D77B3584231C3055DD7ECFA9196D5E8FA742A9B99F1AF,IMPHASH=FEAAA161935B3C215BB6530DC11DB019{8223a6b9-14f8-6902-ef01-000000002b00}8788C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.99\Installer\setup.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.99\Installer\setup.exe" --msedgewebview --delete-old-versions --system-level --verbose-loggingNT AUTHORITY\SYSTEM 13241300x80000000000000009825Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:22:00.874{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\installer\setup.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009826Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:22:00.874{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009827Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:22:00.874{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009828Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:22:00.874{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 154100x80000000000000009829Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:22:17.057{8223a6b9-1509-6902-f101-000000002b00}10836C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe1.3.185.27Microsoft Edge UpdateMicrosoft Edge UpdateMicrosoft Corporationmsedgeupdate.dll"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMDUuOSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4NS4yNyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins1QzNDMkVEMS01RTlDLTQ4Q0ItODcwQS0zOENGREVERDFGRER9IiB1c2VyaWQ9IntBMkM1RThDRS03OTVCLTQ0N0YtOEJGRi04QkI0RjA2QUI1QjV9IiBpbnN0YWxsc291cmNlPSJzY2hlZHVsZXIiIHJlcXVlc3RpZD0iezFCMEZDRTc3LTA4QzgtNEYxMy04NEVBLTUzQ0RBQ0M2NjNDM30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSIyMCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjQ5NDYiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxNjIiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IlZNd2FyZSwgSW5jLiIgcHJvZHVjdF9uYW1lPSJWTXdhcmUyMCwxIi8-PGV4cCBldGFnPSImcXVvdDtIQXJxczYzakpta3YxYlhWb05QcTh6QTYwVSt6TzBXaW1pNGt3SE9IZWRZPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMjA1LjkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzNTEiIGNvaG9ydD0icnJmQDAuNzYiPjx1cGRhdGVjaGVjay8-PHBpbmcgcmQ9IjY4NzYiIHBpbmdfZnJlc2huZXNzPSJ7QzZCN0ZGOTUtRjk0RS00NUQ2LUFGRUUtNkM3OEFENjE0RTA4fSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSIxNDAuMC4zNDg1LjY2IiBuZXh0dmVyc2lvbj0iMTQxLjAuMzUzNy45OSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIzNTEiIGNvaG9ydD0icnJmQDAuMzEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM3NTgxMzU3NzMyMTExNzAiIHVwZGF0ZV9jb3VudD0iNCIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzNDAyNzAxMzg1MjQ0MDMxMCIgZmlyc3RfZnJlX3NlZW5fdGltZT0iMTM0MDEzODM1NDI4NjQ5MzEwIiBmaXJzdF9mcmVfc2Vlbl92ZXJzaW9uPSIxMzkuMC4zNDA1LjEyNSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDI2MTUzMDEzOCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0MjYxNTgzOTgwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ0MTc2NzQzMTAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wOTNmODViOC1hNDc3LTQxMDYtYWY5MS05OGI0MGFkNDdjZTQ_UDE9MTc2MjM0ODg1MyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1NNEtoSjRFNnZ4WWhabXA1SXpqV09KM2FDc1d6WmU5JTJiaGZwRFluakxNRmpnMVVEbHdBJTJmSjFmRzlVb094amFJUEhwMTJCN0olMmY3SGx1TW1JRWhzeklOUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjU1Mjc1MTA0IiB0b3RhbD0iNTUyNzUxMDQiIGRvd25sb2FkX3RpbWVfbXM9IjEzOTQwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ0MTc3NjY1OTYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDQyNTU4OTUxMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDg5MDc2ODY5NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjE2ODgiIGRvd25sb2FkX3RpbWVfbXM9IjE1NjAyIiBkb3dubG9hZGVkPSI1NTI3NTEwNCIgdG90YWw9IjU1Mjc1MTA0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0NjUxOCIvPjxwaW5nIGFjdGl2ZT0iMCIgcmQ9IjY4NzYiIHBpbmdfZnJlc2huZXNzPSJ7NUFDRDRENTUtNzkxMy00MUZBLUJERUEtMzE1OENBM0RDQThCfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDAuMC4zNDg1LjY2IiBuZXh0dmVyc2lvbj0iMTQxLjAuMzUzNy45OSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIzNTEiIGNvaG9ydD0icnJmQDAuNTgiIHVwZGF0ZV9jb3VudD0iMyIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzNDA2MjE3MzA4MjQ4NzEyMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDI2MTU1NjgwNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODkwOTM3NTExIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4OTc4MDU3MzIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDkwNTkzMDIzNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA5ODk1MTExNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjE2OTAiIGRvd25sb2FkZWQ9IjU1Mjc1MTA0IiB0b3RhbD0iNTUyNzUxMDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIyIiBpbnN0YWxsX3RpbWVfbXM9IjE5Mjk5Ii8-PHBpbmcgYWN0aXZlPSIxIiBhZD0iNjg3NiIgcmQ9IjY4NzYiIHBpbmdfZnJlc2huZXNzPSJ7OTUyRUY2QUEtMzc4My00QzVGLUI1NjktOTAxREU4NjA5RjdCfSIvPjwvYXBwPjwvcmVxdWVzdD4C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=733ADFA5081059A471115660D7C11EBB,SHA256=F3C7BAB6A7652E58719CE96EDFEFF483316668BD48D912694F1175FB397B86FD,IMPHASH=CD3B2D99C6655A5D4A14E30E380F5BF9{8223a6b9-14b3-6902-c501-000000002b00}3340C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcNT AUTHORITY\SYSTEM 534500x80000000000000009830Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:03.279{8223a6b9-14ef-6902-e301-000000002b00}11584C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exesoc101win11\Administrator 154100x80000000000000009831Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:09.513{8223a6b9-153d-6902-f201-000000002b00}6780C:\Windows\System32\directxdatabaseupdater.exe10.0.26100.3624 (WinBuild.160101.0800)DirectX Database UpdaterMicrosoft® Windows® Operating SystemMicrosoft CorporationDirectXDatabaseUpdater.exe"C:\WINDOWS\system32\directxdatabaseupdater.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=D2AAAEB94EA9E68B39410D240334F242,SHA256=49A3186F3EC106E8D1281DE9FC189CE3E606418371A8881D4876AD2A748FF6D5,IMPHASH=74B611F908F64357720ABBF5DAF48BF3{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x80000000000000009832Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:11.360{8223a6b9-153f-6902-f401-000000002b00}12072C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009833Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:14.622{8223a6b9-1542-6902-f501-000000002b00}3764C:\Windows\servicing\TrustedInstaller.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Modules InstallerMicrosoft® Windows® Operating SystemMicrosoft CorporationTrustedInstaller.exeC:\WINDOWS\servicing\TrustedInstaller.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=23CF29D35F32448C19398B91E3C31186,SHA256=C037F1D455B27EF75391EECE7F25711CF3055006FA29C5D872DB4D54FEF0ADE8,IMPHASH=5E159CE7599ACD6CA7EC3122186D5DBC{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x80000000000000009834Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:14.676{8223a6b9-1542-6902-f601-000000002b00}6140C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.4933_none_a4edf32577775419\TiWorker.exe10.0.26100.4933 (WinBuild.160101.0800)Windows Modules Installer WorkerMicrosoft® Windows® Operating SystemMicrosoft CorporationTiWorker.exeC:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.4933_none_a4edf32577775419\TiWorker.exe -EmbeddingC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=749679E003C18036BF998EB9BCE36A63,SHA256=3F42DBAF2BD7AD92577AFB6D47A8F3DC32DCB6A8E52BA7738FAEB31ED197ACDC,IMPHASH=0B85588480DF97BD963732E20722340E{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 15241500x80000000000000009835Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:24.564{8223a6b9-1548-6902-f701-000000002b00}12156C:\Program Files\Google\Chrome\Application\chrome.exeC:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exe2025-10-29 13:18:59.228MD5=3F3FB643A297CEAD99CE29679B368C51,SHA256=0E59B73EF9A2D702AA349D85B483C5FF493BE320EC4844DA581EA3627D44183E,IMPHASH=B34F154EC913D2D2C435CBD644E91687-soc101win11\Administrator 11241100x80000000000000009836Microsoft-Windows-Sysmon/Operationalsoc101win11Downloads2025-10-29 13:23:25.912{8223a6b9-1548-6902-f701-000000002b00}12156C:\Program Files\Google\Chrome\Application\chrome.exeC:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exe:Zone.Identifier2025-10-29 13:18:59.228soc101win11\Administrator 15241500x80000000000000009837Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:25.912{8223a6b9-1548-6902-f701-000000002b00}12156C:\Program Files\Google\Chrome\Application\chrome.exeC:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exe:Zone.Identifier2025-10-29 13:18:59.228MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000[ZoneTransfer] ZoneId=3 soc101win11\Administrator 15241500x80000000000000009838Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:25.912{8223a6b9-1548-6902-f701-000000002b00}12156C:\Program Files\Google\Chrome\Application\chrome.exeC:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exe2025-10-29 13:18:59.228MD5=3F3FB643A297CEAD99CE29679B368C51,SHA256=0E59B73EF9A2D702AA349D85B483C5FF493BE320EC4844DA581EA3627D44183E,IMPHASH=B34F154EC913D2D2C435CBD644E91687-soc101win11\Administrator 15241500x80000000000000009839Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:27.308{8223a6b9-1548-6902-f701-000000002b00}12156C:\Program Files\Google\Chrome\Application\chrome.exeC:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exe:Zone.Identifier2025-10-29 13:18:59.228MD5=B6C15324DB8A38A8FC04A69810128993,SHA256=DF6A9658A6E64D3BB73662BBCA935552CD89116ADDFE785BA30988E5BE65B548,IMPHASH=00000000000000000000000000000000[ZoneTransfer] ZoneId=3 ReferrerUrl=https://lmstudio.ai/ soc101win11\Administrator 13241300x80000000000000009840Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:28.663{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\00001898faf7f11810f3e9924b881c7379a800000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 15241500x80000000000000009841Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:27.308{8223a6b9-1548-6902-f701-000000002b00}12156C:\Program Files\Google\Chrome\Application\chrome.exeC:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exe2025-10-29 13:18:59.228MD5=3F3FB643A297CEAD99CE29679B368C51,SHA256=0E59B73EF9A2D702AA349D85B483C5FF493BE320EC4844DA581EA3627D44183E,IMPHASH=B34F154EC913D2D2C435CBD644E91687-soc101win11\Administrator 15241500x80000000000000009842Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:28.788{8223a6b9-1548-6902-f701-000000002b00}12156C:\Program Files\Google\Chrome\Application\chrome.exeC:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exe:Zone.Identifier2025-10-29 13:18:59.228MD5=4D52306740235D0B41B37B52AABCA928,SHA256=D71AA9909BCB0977CD7E757A9A532D87404DDA484DF2B9898B639130D99FB4DB,IMPHASH=00000000000000000000000000000000[ZoneTransfer] ZoneId=3 ReferrerUrl=https://lmstudio.ai/ HostUrl=https://installers.lmstudio.ai/win32/x64/0.3.30-2/LM-Studio-0.3.30-2-x64.exe soc101win11\Administrator 13241300x80000000000000009843Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:30.749{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\00001137dfe0973a35d369698cb7e3e1b1f300000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009844Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:30.749{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\deploymentagent.|eaf9e0f0eec20da\LowerCaseLongPathc:\program files\windowsapps\microsoft.windowsappruntime.1.7_7000.617.2103.0_x86__8wekyb3d8bbwe\deploymentagent.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009845Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:30.749{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\deploymentagent.|eaf9e0f0eec20da\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009846Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:30.749{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\deploymentagent.|eaf9e0f0eec20da\LinkDate03/20/2014 10:13:34NT AUTHORITY\SYSTEM 13241300x80000000000000009847Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:30.751{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\deploymentagent.|eaf9e0f0eec20da\BinProductVersion1.7.0.0NT AUTHORITY\SYSTEM 13241300x80000000000000009848Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:30.751{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\restartagent.exe|8132b012edcf9831\LowerCaseLongPathc:\program files\windowsapps\microsoft.windowsappruntime.1.7_7000.617.2103.0_x86__8wekyb3d8bbwe\restartagent.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009849Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:30.751{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\restartagent.exe|8132b012edcf9831\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009850Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:30.751{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\restartagent.exe|8132b012edcf9831\LinkDate12/24/1989 13:18:40NT AUTHORITY\SYSTEM 13241300x80000000000000009851Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:30.751{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\restartagent.exe|8132b012edcf9831\BinProductVersion1.7.0.0NT AUTHORITY\SYSTEM 154100x80000000000000009852Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:30.807{8223a6b9-1552-6902-f901-000000002b00}2452C:\Windows\System32\UCConfigTask.exe-----"C:\WINDOWS\system32\UCConfigTask.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=BA4296C76B62029E6A2F2DDF0A6BB46D,SHA256=2101694E6FF5C9DD56D5C1060E7C1C86E8E41771A232E473568170AD76B35B25,IMPHASH=75AF2A195BD7CBDCEB4EDB2C9DB099B8{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 13241300x80000000000000009853Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.076{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\000091a2189776cb647370517d0a1b63ae8e00000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009854Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.076{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mspaint.exe|723501e00031a7ac\LowerCaseLongPathc:\program files\windowsapps\microsoft.paint_11.2507.371.0_x64__8wekyb3d8bbwe\paintapp\mspaint.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009855Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.076{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mspaint.exe|723501e00031a7ac\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009856Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.076{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mspaint.exe|723501e00031a7ac\LinkDate08/27/2025 15:57:15NT AUTHORITY\SYSTEM 13241300x80000000000000009857Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.076{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mspaint.exe|723501e00031a7ac\BinProductVersion11.2507.371.0NT AUTHORITY\SYSTEM 13241300x80000000000000009858Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.181{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\000044ca90c0a87425537d444a6ac152119400000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009859Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.181{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|d841cb9496114e09\LowerCaseLongPathc:\program files\windowsapps\microsoft.yourphone_1.25082.136.0_x64__8wekyb3d8bbwe\createdump.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009860Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.181{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|d841cb9496114e09\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009861Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.181{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|d841cb9496114e09\LinkDate08/19/2025 22:12:52NT AUTHORITY\SYSTEM 13241300x80000000000000009862Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.181{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|d841cb9496114e09\BinProductVersion9.0.925.41916NT AUTHORITY\SYSTEM 13241300x80000000000000009863Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.181{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\phoneexperienceh|df5907bdaf7c435a\LowerCaseLongPathc:\program files\windowsapps\microsoft.yourphone_1.25082.136.0_x64__8wekyb3d8bbwe\phoneexperiencehost.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009864Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.181{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\phoneexperienceh|df5907bdaf7c435a\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009865Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.181{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\phoneexperienceh|df5907bdaf7c435a\LinkDate08/19/2025 04:39:28NT AUTHORITY\SYSTEM 13241300x80000000000000009866Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.181{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\phoneexperienceh|df5907bdaf7c435a\BinProductVersion1.25082.136.0NT AUTHORITY\SYSTEM 13241300x80000000000000009867Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.181{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\yourphoneappprox|4e782c7d01720a24\LowerCaseLongPathc:\program files\windowsapps\microsoft.yourphone_1.25082.136.0_x64__8wekyb3d8bbwe\yourphoneappproxy.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009868Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.184{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\yourphoneappprox|4e782c7d01720a24\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009869Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.184{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\yourphoneappprox|4e782c7d01720a24\LinkDate08/19/2025 04:39:28NT AUTHORITY\SYSTEM 13241300x80000000000000009870Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.184{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\yourphoneappprox|4e782c7d01720a24\BinProductVersion1.25082.136.0NT AUTHORITY\SYSTEM 13241300x80000000000000009871Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.409{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000e92459596134a439ba50756e43e1d8e500000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009872Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.409{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\photos.autoplay.|3e0a74bf7a5a7905\LowerCaseLongPathc:\program files\windowsapps\microsoft.windows.photos_2025.11080.28001.0_x64__8wekyb3d8bbwe\photos.autoplay.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009873Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.409{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\photos.autoplay.|3e0a74bf7a5a7905\LinkDate08/28/2025 07:18:00NT AUTHORITY\SYSTEM 13241300x80000000000000009874Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.409{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\photos.exe|3ad4c704ac8d2f8c\LowerCaseLongPathc:\program files\windowsapps\microsoft.windows.photos_2025.11080.28001.0_x64__8wekyb3d8bbwe\photos.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009875Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.409{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\photos.exe|3ad4c704ac8d2f8c\LinkDate08/28/2025 07:42:46NT AUTHORITY\SYSTEM 13241300x80000000000000009876Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.425{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\000012a37ac2fcade370a60ffba83e7ba53b00000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009877Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.425{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\storeexperienceh|c90c6b4fa357acd\LowerCaseLongPathc:\program files\windowsapps\microsoft.storepurchaseapp_22507.1401.8.0_x64__8wekyb3d8bbwe\storeexperiencehost.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009878Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.425{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\storeexperienceh|c90c6b4fa357acd\LinkDate09/09/2025 20:21:41NT AUTHORITY\SYSTEM 13241300x80000000000000009879Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.425{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\storeexperienceh|c90c6b4fa357acd\BinProductVersion0.0.0.0NT AUTHORITY\SYSTEM 13241300x80000000000000009880Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.464{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000079d8a2ffe8e33604e7d20381d7cb05600000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009881Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.464{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftstartfe|54aecbc47cf0b4b3\LowerCaseLongPathc:\program files\windowsapps\microsoft.startexperiencesapp_1.124.0.0_x64__8wekyb3d8bbwe\microsoftstartfeedprovider\microsoftstartfeedprovider.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009882Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.464{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftstartfe|54aecbc47cf0b4b3\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009883Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.464{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftstartfe|54aecbc47cf0b4b3\LinkDate08/26/2025 07:13:02NT AUTHORITY\SYSTEM 13241300x80000000000000009884Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.464{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftstartfe|54aecbc47cf0b4b3\BinProductVersion1.124.0.0NT AUTHORITY\SYSTEM 13241300x80000000000000009885Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.553{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ucconfigtask.exe|952bd19eaba80568\LowerCaseLongPathc:\windows\system32\ucconfigtask.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009886Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.553{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ucconfigtask.exe|952bd19eaba80568\LinkDate10/27/2093 14:57:06NT AUTHORITY\SYSTEM 13241300x80000000000000009887Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\00007f2be4685f7219cbd40c10bc3e341ace00000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009888Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|46d9b92d14d618fc\LowerCaseLongPathc:\program files\windowsapps\microsoftwindows.crossdevice_1.25082.70.0_x64__cw5n1h2txyewy\createdump.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009889Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|46d9b92d14d618fc\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009890Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|46d9b92d14d618fc\LinkDate08/19/2025 22:12:52NT AUTHORITY\SYSTEM 13241300x80000000000000009891Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|46d9b92d14d618fc\BinProductVersion9.0.925.41916NT AUTHORITY\SYSTEM 13241300x80000000000000009892Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicefiles|8438f09b49fc08ac\LowerCaseLongPathc:\program files\windowsapps\microsoftwindows.crossdevice_1.25082.70.0_x64__cw5n1h2txyewy\crossdevicefileshost.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009893Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicefiles|8438f09b49fc08ac\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009894Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicefiles|8438f09b49fc08ac\LinkDate08/19/2025 04:39:28NT AUTHORITY\SYSTEM 13241300x80000000000000009895Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicefiles|8438f09b49fc08ac\BinProductVersion1.25082.70.0NT AUTHORITY\SYSTEM 13241300x80000000000000009896Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdeviceservi|ebb6c0cb0a2c8bd0\LowerCaseLongPathc:\program files\windowsapps\microsoftwindows.crossdevice_1.25082.70.0_x64__cw5n1h2txyewy\crossdeviceservice.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009897Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdeviceservi|ebb6c0cb0a2c8bd0\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009898Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdeviceservi|ebb6c0cb0a2c8bd0\LinkDate08/19/2025 04:39:28NT AUTHORITY\SYSTEM 13241300x80000000000000009899Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdeviceservi|ebb6c0cb0a2c8bd0\BinProductVersion1.25082.70.0NT AUTHORITY\SYSTEM 13241300x80000000000000009900Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicesetti|27673d1892c992\LowerCaseLongPathc:\program files\windowsapps\microsoftwindows.crossdevice_1.25082.70.0_x64__cw5n1h2txyewy\crossdevicesettingshost.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009901Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicesetti|27673d1892c992\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009902Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicesetti|27673d1892c992\LinkDate08/19/2025 04:39:28NT AUTHORITY\SYSTEM 13241300x80000000000000009903Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicesetti|27673d1892c992\BinProductVersion1.25082.70.0NT AUTHORITY\SYSTEM 13241300x80000000000000009904Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicestrea|a51ba49c69cfdcc0\LowerCaseLongPathc:\program files\windowsapps\microsoftwindows.crossdevice_1.25082.70.0_x64__cw5n1h2txyewy\crossdevicestreaminghost.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009905Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicestrea|a51ba49c69cfdcc0\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009906Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicestrea|a51ba49c69cfdcc0\LinkDate08/19/2025 04:39:28NT AUTHORITY\SYSTEM 13241300x80000000000000009907Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.569{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\crossdevicestrea|a51ba49c69cfdcc0\BinProductVersion1.25082.70.0NT AUTHORITY\SYSTEM 13241300x80000000000000009908Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\00005aa9ecfb2365777989444f47138d55a500000908\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009909Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\agentproxy.exe|e509db705225c07b\LowerCaseLongPathc:\program files\windowsapps\microsoft.copilot_1.25091.124.0_x64__8wekyb3d8bbwe\agentisolationenvironment.agentproxy\agentproxy.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009910Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\agentproxy.exe|e509db705225c07b\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009911Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\agentproxy.exe|e509db705225c07b\LinkDate08/30/2025 05:05:06NT AUTHORITY\SYSTEM 13241300x80000000000000009912Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\agentproxy.exe|e509db705225c07b\BinProductVersion2125.24201.0.2000NT AUTHORITY\SYSTEM 13241300x80000000000000009913Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\agentrelay.exe|32fe7372493d232d\LowerCaseLongPathc:\program files\windowsapps\microsoft.copilot_1.25091.124.0_x64__8wekyb3d8bbwe\agentisolationenvironment.agentrelay\agentrelay.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009914Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\agentrelay.exe|32fe7372493d232d\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009915Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\agentrelay.exe|32fe7372493d232d\LinkDate08/30/2025 05:04:20NT AUTHORITY\SYSTEM 13241300x80000000000000009916Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\agentrelay.exe|32fe7372493d232d\BinProductVersion2125.24201.0.2000NT AUTHORITY\SYSTEM 13241300x80000000000000009917Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\copilot.exe|a86a46355acf5494\LowerCaseLongPathc:\program files\windowsapps\microsoft.copilot_1.25091.124.0_x64__8wekyb3d8bbwe\copilot.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009918Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\copilot.exe|a86a46355acf5494\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009919Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\copilot.exe|a86a46355acf5494\LinkDate02/11/2025 07:45:04NT AUTHORITY\SYSTEM 13241300x80000000000000009920Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\copilot.exe|a86a46355acf5494\BinProductVersion1.25091.124.0NT AUTHORITY\SYSTEM 13241300x80000000000000009921Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|b0c370b2e1f8ac64\LowerCaseLongPathc:\program files\windowsapps\microsoft.copilot_1.25091.124.0_x64__8wekyb3d8bbwe\createdump.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009922Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|b0c370b2e1f8ac64\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009923Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|b0c370b2e1f8ac64\LinkDate02/11/2025 23:09:42NT AUTHORITY\SYSTEM 13241300x80000000000000009924Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:31.797{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\createdump.exe|b0c370b2e1f8ac64\BinProductVersion9.0.325.11113NT AUTHORITY\SYSTEM 13241300x80000000000000009925Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.828{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000f3edcca02b28fa6b6d9d886193d7eb9f00000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009926Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.839{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\000043f06e4606a5b0c90f145bdb54661d0000000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009927Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.855{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000f09fcf839436ef615329a18436d6aa2e00000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009928Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.870{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\000058c74b90854c6b3a83fc0cd662ac4be100000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009929Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.892{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\00000df41590f3481bc998f901d143c291a400000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009930Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.902{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000569dfd1f6adc82a052cfeb27ef8c6b6500000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009931Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.918{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\00002533c0dff4125d8fc07606d0a4b49d0200000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009932Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.953{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000cc270d2e4ef4706301e2213b1382de5400000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009933Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:31.982{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\000039db4df8972173e2e0deada82651bed300000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009934Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.014{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\00006963d9cfac7c245904b67305ad8368ac00000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009935Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.029{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000e800eeac9188434fa52e713804c1fb5c00000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009936Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.045{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000dd856eb319dd32b99d9876fea4c1c58b00000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009937Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.077{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\000060aee02a7225d270f3b317fb16974b8100000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009938Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.077{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000d17efb60f5d138ca7f8a6dae92cc17e000000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009939Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.262{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000dc311b89ca05b069701a29970a7a512f00000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009940Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.300{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000a2aec90feb6b539db4194812ad27c1bb00000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009941Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.356{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000e8e99392cff038618d746cc72420b70e00000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009942Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.378{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000ec14a9b7fc41e90fa6633fc736ff678600000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009943Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.394{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\00009173232e564a14ac7b645882045838d100000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009944Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.810{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\00002d95c5cf28fcb603e20e86d44fd965dd00000904\PublisherCN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009945Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.826{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\000068b962a8b5122674befacd0a81a6198400000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009946Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.886{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\00009dc11adba88ba05ef8088e8572b094ab00000904\PublisherCN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USNT AUTHORITY\SYSTEM 13241300x80000000000000009947Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:32.886{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\m365copilot_auto|17a74268e2ad7c59\LowerCaseLongPathc:\program files\windowsapps\microsoft.microsoftofficehub_19.2509.42011.0_x64__8wekyb3d8bbwe\m365copilot_autostarter.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009948Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:32.886{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\m365copilot_auto|17a74268e2ad7c59\LinkDate09/12/2025 08:00:01NT AUTHORITY\SYSTEM 13241300x80000000000000009949Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:32.886{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\webviewhost.exe|b22ed0c091271a9b\LowerCaseLongPathc:\program files\windowsapps\microsoft.microsoftofficehub_19.2509.42011.0_x64__8wekyb3d8bbwe\webviewhost.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009950Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:32.886{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\webviewhost.exe|b22ed0c091271a9b\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009951Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:32.886{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\webviewhost.exe|b22ed0c091271a9b\LinkDate09/12/2025 08:02:59NT AUTHORITY\SYSTEM 13241300x80000000000000009952Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:32.886{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\webviewhost.exe|b22ed0c091271a9b\BinProductVersion19.2509.42011.0NT AUTHORITY\SYSTEM 13241300x80000000000000009953Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.125{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\installer\setup.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009954Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.125{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009955Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.125{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\LinkDate141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009956Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.125{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009957Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000112aaceed10be720d4ace1ca5200709d0000ffff\PublisherMicrosoft CorporationNT AUTHORITY\SYSTEM 13241300x80000000000000009958Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|53867648d9dc368b\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\cookie_exporter.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009959Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|53867648d9dc368b\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009960Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|53867648d9dc368b\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009961Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|53867648d9dc368b\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009962Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|28978edf65eea7d3\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\elevated_tracing_service.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009963Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|28978edf65eea7d3\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009964Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|28978edf65eea7d3\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009965Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|28978edf65eea7d3\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009966Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|3128a6298f3f6b35\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\elevation_service.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009967Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|3128a6298f3f6b35\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009968Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|3128a6298f3f6b35\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009969Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|3128a6298f3f6b35\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009970Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|7b3e819cf9c8fac6\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\identity_helper.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009971Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|7b3e819cf9c8fac6\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009972Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|7b3e819cf9c8fac6\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009973Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|7b3e819cf9c8fac6\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009974Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|f9ac0b84441b964a\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\bho\ie_to_edge_stub.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009975Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|f9ac0b84441b964a\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009976Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|f9ac0b84441b964a\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009977Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|f9ac0b84441b964a\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009978Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|397072706b6e96c0\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\msedge.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009979Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|397072706b6e96c0\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009980Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|397072706b6e96c0\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009981Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|397072706b6e96c0\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009982Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|f5eaddb50d509bdb\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\msedge_proxy.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009983Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|f5eaddb50d509bdb\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009984Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|f5eaddb50d509bdb\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009985Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|f5eaddb50d509bdb\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009986Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|d44f8514d7a214ce\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\msedge_pwa_launcher.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009987Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|d44f8514d7a214ce\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009988Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|d44f8514d7a214ce\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009989Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|d44f8514d7a214ce\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009990Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|4f731802fc11a414\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\msedgewebview2.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009991Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|4f731802fc11a414\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009992Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.161{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|4f731802fc11a414\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009993Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|4f731802fc11a414\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009994Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_cli|ba9a3277d189baa9\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\notification_click_helper.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009995Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_cli|ba9a3277d189baa9\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x80000000000000009996Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_cli|ba9a3277d189baa9\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x80000000000000009997Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_cli|ba9a3277d189baa9\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x80000000000000009998Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|6a375e38398c8585\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\notification_helper.exeNT AUTHORITY\SYSTEM 13241300x80000000000000009999Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|6a375e38398c8585\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010000Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|6a375e38398c8585\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010001Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|6a375e38398c8585\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010002Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|f2bd50cea6cdec63\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\pwahelper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010003Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|f2bd50cea6cdec63\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010004Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|f2bd50cea6cdec63\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010005Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|f2bd50cea6cdec63\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010006Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\141.0.3537.99\installer\setup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010007Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010008Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010009Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.177{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|1915d9d248cc8324\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010010Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.193{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|ab31671306fc9285\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\installer\setup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010011Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.193{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|ab31671306fc9285\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010012Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.193{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|ab31671306fc9285\LinkDate140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010013Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.193{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|ab31671306fc9285\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010014Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.239{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|d7d47c01d8603af5\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\msedgewebview2.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010015Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.239{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|d7d47c01d8603af5\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010016Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.239{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|d7d47c01d8603af5\LinkDate140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010017Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.239{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|d7d47c01d8603af5\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010018Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.272{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\installer\setup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010019Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.272{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010020Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.272{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\LinkDate141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010021Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.272{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010022Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.320{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\000022285551e18dfbea5107dc27ddcb2f190000ffff\PublisherMicrosoft CorporationNT AUTHORITY\SYSTEM 13241300x800000000000000010023Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.320{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|59bd29186f5de469\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\cookie_exporter.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010024Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.320{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|59bd29186f5de469\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010025Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.320{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|59bd29186f5de469\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010026Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.320{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|59bd29186f5de469\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010027Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|723d9e1dd2b52060\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\cookie_exporter.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010028Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|723d9e1dd2b52060\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010029Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|723d9e1dd2b52060\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010030Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|723d9e1dd2b52060\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010031Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|28333de23c7184d6\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\elevated_tracing_service.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010032Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|28333de23c7184d6\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010033Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|28333de23c7184d6\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010034Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|28333de23c7184d6\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010035Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|c980083d9c807a92\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\elevated_tracing_service.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010036Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|c980083d9c807a92\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010037Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|c980083d9c807a92\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010038Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|c980083d9c807a92\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010039Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|4fce3072ba1311c\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\elevation_service.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010040Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|4fce3072ba1311c\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010041Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|4fce3072ba1311c\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010042Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|4fce3072ba1311c\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010043Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|adba66d024e97241\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\elevation_service.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010044Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|adba66d024e97241\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010045Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|adba66d024e97241\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010046Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|adba66d024e97241\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010047Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.324{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|3203fa8f9c24b9ad\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\identity_helper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010048Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|3203fa8f9c24b9ad\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010049Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|3203fa8f9c24b9ad\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010050Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|3203fa8f9c24b9ad\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010051Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|58968d12637af4b5\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\identity_helper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010052Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|58968d12637af4b5\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010053Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|58968d12637af4b5\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010054Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|58968d12637af4b5\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010055Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|5a7619150ed80bc4\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\bho\ie_to_edge_stub.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010056Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|5a7619150ed80bc4\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010057Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|5a7619150ed80bc4\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010058Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|5a7619150ed80bc4\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010059Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|92f46338c62de03a\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\bho\ie_to_edge_stub.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010060Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|92f46338c62de03a\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010061Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|92f46338c62de03a\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010062Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|92f46338c62de03a\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010063Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|6c06d9080e581f62\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\msedge.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010064Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|6c06d9080e581f62\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010065Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|6c06d9080e581f62\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010066Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|6c06d9080e581f62\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010067Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|706431e322c0a298\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\msedge.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010068Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|706431e322c0a298\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010069Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|706431e322c0a298\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010070Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|706431e322c0a298\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010071Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.326{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|14fe4ae20fada540\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\msedge_proxy.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010072Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|14fe4ae20fada540\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010073Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|14fe4ae20fada540\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010074Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|14fe4ae20fada540\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010075Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|ebad7d0b78340a85\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\msedge_proxy.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010076Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|ebad7d0b78340a85\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010077Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|ebad7d0b78340a85\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010078Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|ebad7d0b78340a85\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010079Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|1c26b3aa04a81858\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\msedge_pwa_launcher.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010080Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|1c26b3aa04a81858\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010081Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|1c26b3aa04a81858\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010082Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|1c26b3aa04a81858\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010083Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|b658d357214c2291\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\msedge_pwa_launcher.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010084Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|b658d357214c2291\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010085Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|b658d357214c2291\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010086Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|b658d357214c2291\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010087Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|1abc869faf5353f4\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\msedgewebview2.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010088Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|1abc869faf5353f4\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010089Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|1abc869faf5353f4\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010090Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|1abc869faf5353f4\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010091Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|d7d47c01d8603af5\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\msedgewebview2.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010092Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|d7d47c01d8603af5\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010093Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|d7d47c01d8603af5\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010094Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|d7d47c01d8603af5\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010095Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|20457060ad0b9f79\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\notification_helper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010096Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|20457060ad0b9f79\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010097Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|20457060ad0b9f79\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010098Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|20457060ad0b9f79\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010099Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|fdaea5f4b591a6a4\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\notification_helper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010100Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|fdaea5f4b591a6a4\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010101Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|fdaea5f4b591a6a4\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010102Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|fdaea5f4b591a6a4\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010103Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|3f1d1eede729e83b\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\pwahelper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010104Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|3f1d1eede729e83b\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010105Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|3f1d1eede729e83b\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010106Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|3f1d1eede729e83b\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010107Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|f0ff9d1872bc8f70\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\pwahelper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010108Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|f0ff9d1872bc8f70\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010109Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|f0ff9d1872bc8f70\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010110Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|f0ff9d1872bc8f70\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010111Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\141.0.3537.99\installer\setup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010112Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010113Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010114Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|3338ebb40de4af6c\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010115Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|ab31671306fc9285\LowerCaseLongPathc:\program files (x86)\microsoft\edgewebview\application\140.0.3485.66\installer\setup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010116Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|ab31671306fc9285\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010117Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|ab31671306fc9285\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010118Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.328{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|ab31671306fc9285\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010119Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.911{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\filecoauth.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010120Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.911{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010121Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.911{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\LinkDate25.189.0928.0002NT AUTHORITY\SYSTEM 13241300x800000000000000010122Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.911{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010123Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.911{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\filesyncconfig.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010124Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.911{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010125Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.911{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\LinkDate25.189.0928.0002NT AUTHORITY\SYSTEM 13241300x800000000000000010126Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.911{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010127Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:33.935{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\onedrive.sync.service.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010128Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:33.935{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010129Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:33.935{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\LinkDate25.189.0928.0002NT AUTHORITY\SYSTEM 13241300x800000000000000010130Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:33.935{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010131Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\00005a7097cea0b2fa182cc8223f6b294bc30000ffff\PublisherMicrosoft CorporationNT AUTHORITY\SYSTEM 13241300x800000000000000010132Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\filecoauth.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010133Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010134Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\LinkDate10/08/2061 11:05:30NT AUTHORITY\SYSTEM 13241300x800000000000000010135Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filecoauth.exe|5f0b1f4756058f94\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010136Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\filesyncconfig.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010137Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010138Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\LinkDate05/17/2076 18:38:07NT AUTHORITY\SYSTEM 13241300x800000000000000010139Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesyncconfig.e|b2853778e6ee8154\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010140Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesynchelper.e|ea26329face44024\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\filesynchelper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010141Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesynchelper.e|ea26329face44024\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010142Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesynchelper.e|ea26329face44024\LinkDate05/30/2092 12:56:26NT AUTHORITY\SYSTEM 13241300x800000000000000010143Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\filesynchelper.e|ea26329face44024\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010144Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoft.sharep|3747d2b58102875e\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\microsoft.sharepoint.nativemessagingclient.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010145Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoft.sharep|3747d2b58102875e\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010146Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoft.sharep|3747d2b58102875e\LinkDate11/24/2001 21:38:21NT AUTHORITY\SYSTEM 13241300x800000000000000010147Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoft.sharep|3747d2b58102875e\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010148Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\onedrive.sync.service.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010149Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010150Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\LinkDate06/22/2006 02:04:35NT AUTHORITY\SYSTEM 13241300x800000000000000010151Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:34.010{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.sync.se|3653c6c06bfe42d7\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010152Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedriveactionhe|b1cd88fadc09ffdd\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\onedriveactionhelper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010153Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedriveactionhe|b1cd88fadc09ffdd\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010154Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedriveactionhe|b1cd88fadc09ffdd\LinkDate06/02/1988 14:32:27NT AUTHORITY\SYSTEM 13241300x800000000000000010155Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedriveactionhe|b1cd88fadc09ffdd\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010156Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivefilelaun|cb622fc3f64a4519\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\onedrivefilelauncher.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010157Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivefilelaun|cb622fc3f64a4519\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010158Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivefilelaun|cb622fc3f64a4519\LinkDate06/01/2031 03:12:11NT AUTHORITY\SYSTEM 13241300x800000000000000010159Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivefilelaun|cb622fc3f64a4519\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010160Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivelauncher|f99f243c317f1f57\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\onedrivelauncher.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010161Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivelauncher|f99f243c317f1f57\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010162Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivelauncher|f99f243c317f1f57\LinkDate12/08/1972 16:28:20NT AUTHORITY\SYSTEM 13241300x800000000000000010163Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivelauncher|f99f243c317f1f57\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010164Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivepatcher.|9c9c196e5cac49fd\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\onedrivepatcher.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010165Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivepatcher.|9c9c196e5cac49fd\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010166Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivepatcher.|9c9c196e5cac49fd\LinkDate10/23/2034 03:50:25NT AUTHORITY\SYSTEM 13241300x800000000000000010167Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivepatcher.|9c9c196e5cac49fd\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010168Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|f253b398e0182f01\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\onedrivesetup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010169Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|f253b398e0182f01\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010170Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|f253b398e0182f01\LinkDate11/28/2034 23:04:51NT AUTHORITY\SYSTEM 13241300x800000000000000010171Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|f253b398e0182f01\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010172Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedriveupdaters|aa78feaff60c8b83\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\25.189.0928.0002\onedriveupdaterservice.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010173Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedriveupdaters|aa78feaff60c8b83\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010174Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedriveupdaters|aa78feaff60c8b83\LinkDate12/19/2086 04:11:22NT AUTHORITY\SYSTEM 13241300x800000000000000010175Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:34.012{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedriveupdaters|aa78feaff60c8b83\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010176Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:34.018{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplication\0000c9e25167b28e9201de9581a3277f77b60000ffff\PublisherOllamaNT AUTHORITY\SYSTEM 13241300x800000000000000010177Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.285{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|1acaf145e1abe71e\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\bho\ie_to_edge_stub.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010178Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.285{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|1acaf145e1abe71e\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010179Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.285{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|1acaf145e1abe71e\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010180Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.285{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|1acaf145e1abe71e\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010181Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.285{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|404fc78ba95cc1a0\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\cookie_exporter.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010182Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.285{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|404fc78ba95cc1a0\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010183Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.285{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|404fc78ba95cc1a0\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010184Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.285{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|404fc78ba95cc1a0\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010185Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.295{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|8161afd9a053497f\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\elevated_tracing_service.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010186Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.295{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|8161afd9a053497f\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010187Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.295{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|8161afd9a053497f\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010188Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.295{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|8161afd9a053497f\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010189Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.299{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|e199190571ead391\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\elevation_service.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010190Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.299{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|e199190571ead391\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010191Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.299{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|e199190571ead391\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010192Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.301{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|e199190571ead391\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010193Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.303{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|cd1d678d615d9802\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\identity_helper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010194Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.303{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|cd1d678d615d9802\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010195Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.303{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|cd1d678d615d9802\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010196Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.303{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|cd1d678d615d9802\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010197Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.309{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|e099519a83047302\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\installer\setup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010198Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.309{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|e099519a83047302\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010199Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.309{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|e099519a83047302\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010200Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.309{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|e099519a83047302\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010201Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.325{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|46fd910c0892a592\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\msedge.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010202Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.325{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|46fd910c0892a592\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010203Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.325{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|46fd910c0892a592\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010204Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.325{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|46fd910c0892a592\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010205Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.333{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|a63e21e9417c1a69\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\msedgewebview2.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010206Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.333{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|a63e21e9417c1a69\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010207Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.333{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|a63e21e9417c1a69\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010208Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.333{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|a63e21e9417c1a69\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010209Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.335{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|150d4ba8448897b1\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\msedge_proxy.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010210Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.337{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|150d4ba8448897b1\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010211Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.337{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|150d4ba8448897b1\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010212Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.337{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|150d4ba8448897b1\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010213Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.339{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|ffabf763a4c2d1c5\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\msedge_pwa_launcher.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010214Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.341{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|ffabf763a4c2d1c5\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010215Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.341{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|ffabf763a4c2d1c5\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010216Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.341{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|ffabf763a4c2d1c5\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010217Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.345{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|341a662cf50c0304\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\notification_helper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010218Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.345{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|341a662cf50c0304\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010219Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.345{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|341a662cf50c0304\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010220Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.345{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|341a662cf50c0304\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010221Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.347{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|53bda93ff593c6a0\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\140.0.3485.66\pwahelper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010222Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.347{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|53bda93ff593c6a0\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010223Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.347{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|53bda93ff593c6a0\LinkDate09/10/2025 23:48:58NT AUTHORITY\SYSTEM 13241300x800000000000000010224Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.347{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|53bda93ff593c6a0\BinProductVersion140.0.3485.66NT AUTHORITY\SYSTEM 13241300x800000000000000010225Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.349{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|17d43445aa3c078\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\bho\ie_to_edge_stub.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010226Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.349{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|17d43445aa3c078\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010227Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.349{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|17d43445aa3c078\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010228Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.349{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie_to_edge_stub.|17d43445aa3c078\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010229Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.351{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|9d66eed77bd00f42\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\cookie_exporter.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010230Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.351{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|9d66eed77bd00f42\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010231Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.351{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|9d66eed77bd00f42\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010232Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.351{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cookie_exporter.|9d66eed77bd00f42\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010233Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.359{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|8658cc24c4119f97\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\elevated_tracing_service.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010234Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.359{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|8658cc24c4119f97\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010235Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.359{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|8658cc24c4119f97\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010236Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.359{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevated_tracing|8658cc24c4119f97\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010237Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.363{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|f20992b98bb165c7\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\elevation_service.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010238Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.363{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|f20992b98bb165c7\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010239Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.363{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|f20992b98bb165c7\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010240Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.363{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|f20992b98bb165c7\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010241Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.367{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|99118bd8845656f0\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\identity_helper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010242Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.367{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|99118bd8845656f0\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010243Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.367{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|99118bd8845656f0\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010244Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.367{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\identity_helper.|99118bd8845656f0\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010245Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.380{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|bcd7617720224c11\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\installer\setup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010246Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.380{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|bcd7617720224c11\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010247Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.380{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|bcd7617720224c11\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010248Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.380{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\setup.exe|bcd7617720224c11\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010249Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.388{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|6391ab2b5815f38d\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\msedge.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010250Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.388{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|6391ab2b5815f38d\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010251Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.388{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|6391ab2b5815f38d\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010252Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.388{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|6391ab2b5815f38d\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010253Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.397{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|65fe032a30e2148e\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\msedgewebview2.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010254Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.397{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|65fe032a30e2148e\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010255Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.397{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|65fe032a30e2148e\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010256Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.397{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedgewebview2.e|65fe032a30e2148e\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010257Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.399{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|1e00277a889e149a\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\msedge_proxy.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010258Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.399{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|1e00277a889e149a\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010259Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.399{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|1e00277a889e149a\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010260Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.399{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|1e00277a889e149a\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010261Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.404{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|b31e024e30af393a\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\msedge_pwa_launcher.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010262Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.404{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|b31e024e30af393a\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010263Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.404{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|b31e024e30af393a\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010264Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.404{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_pwa_launc|b31e024e30af393a\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010265Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.408{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|3123937865dac7e8\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\notification_helper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010266Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.408{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|3123937865dac7e8\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010267Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.408{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|3123937865dac7e8\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010268Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.408{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\notification_hel|3123937865dac7e8\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010269Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.410{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|958cf723367e4d5b\LowerCaseLongPathc:\program files (x86)\microsoft\edgecore\141.0.3537.99\pwahelper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010270Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.410{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|958cf723367e4d5b\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010271Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.410{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|958cf723367e4d5b\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010272Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.412{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|958cf723367e4d5b\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010273Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.412{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgecom|6f5011a9c5b71d1d\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\1.3.205.9\microsoftedgecomregistershellarm64.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010274Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.412{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgecom|6f5011a9c5b71d1d\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010275Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.412{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgecom|6f5011a9c5b71d1d\LinkDate10/20/2025 17:57:06NT AUTHORITY\SYSTEM 13241300x800000000000000010276Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.412{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgecom|6f5011a9c5b71d1d\BinProductVersion1.3.205.9NT AUTHORITY\SYSTEM 13241300x800000000000000010277Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.414{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|9e123db33de3f9bc\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\1.3.205.9\microsoftedgeupdate.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010278Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.414{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|9e123db33de3f9bc\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010279Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.414{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|9e123db33de3f9bc\LinkDate10/20/2025 17:57:10NT AUTHORITY\SYSTEM 13241300x800000000000000010280Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.414{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|9e123db33de3f9bc\BinProductVersion1.3.205.9NT AUTHORITY\SYSTEM 13241300x800000000000000010281Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.414{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|10fd265dc2069a15\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\1.3.205.9\microsoftedgeupdatebroker.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010282Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.414{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|10fd265dc2069a15\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010283Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.414{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|10fd265dc2069a15\LinkDate10/20/2025 17:56:53NT AUTHORITY\SYSTEM 13241300x800000000000000010284Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.414{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|10fd265dc2069a15\BinProductVersion1.3.205.9NT AUTHORITY\SYSTEM 13241300x800000000000000010285Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.416{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|f70aec41efce2ace\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\1.3.205.9\microsoftedgeupdatecore.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010286Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.416{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|f70aec41efce2ace\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010287Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.416{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|f70aec41efce2ace\LinkDate10/20/2025 17:57:01NT AUTHORITY\SYSTEM 13241300x800000000000000010288Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.416{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|f70aec41efce2ace\BinProductVersion1.3.205.9NT AUTHORITY\SYSTEM 13241300x800000000000000010289Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.416{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|31c60b0515a9ca16\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\1.3.205.9\microsoftedgeupdateondemand.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010290Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.418{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|31c60b0515a9ca16\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010291Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.418{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|31c60b0515a9ca16\LinkDate10/20/2025 17:56:51NT AUTHORITY\SYSTEM 13241300x800000000000000010292Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.418{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|31c60b0515a9ca16\BinProductVersion1.3.205.9NT AUTHORITY\SYSTEM 13241300x800000000000000010293Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.422{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|2924a8d383ffa0fc\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\1.3.205.9\microsoftedgeupdatesetup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010294Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.422{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|2924a8d383ffa0fc\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010295Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.422{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|2924a8d383ffa0fc\LinkDate10/20/2025 17:59:17NT AUTHORITY\SYSTEM 13241300x800000000000000010296Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.422{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|2924a8d383ffa0fc\BinProductVersion1.3.205.9NT AUTHORITY\SYSTEM 13241300x800000000000000010297Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.467{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|38bd14226e25a784\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\download\{56eb18f8-b008-4cbd-b6d2-8c97fe7e9062}\141.0.3537.99\microsoftedge_x64_141.0.3537.99_140.0.3485.66.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010298Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.467{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|38bd14226e25a784\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010299Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.467{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|38bd14226e25a784\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010300Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.467{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|38bd14226e25a784\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010301Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.531{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|48941f7759d95209\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\download\{f3017226-fe2a-4295-8bdf-00c3a9a7e4c5}\141.0.3537.99\microsoftedge_x64_141.0.3537.99_140.0.3485.66.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010302Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.531{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|48941f7759d95209\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010303Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.531{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|48941f7759d95209\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010304Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.531{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedge_x6|48941f7759d95209\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010305Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.536{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|b8156a9b962f7e67\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.205.9\microsoftedgeupdatesetup_x86_1.3.205.9.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010306Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.536{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|b8156a9b962f7e67\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010307Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.536{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|b8156a9b962f7e67\LinkDate10/20/2025 17:59:17NT AUTHORITY\SYSTEM 13241300x800000000000000010308Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.536{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|b8156a9b962f7e67\BinProductVersion1.3.205.9NT AUTHORITY\SYSTEM 13241300x800000000000000010309Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.947{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.app.exe|69f6721f74b53fa9\LowerCaseLongPathc:\users\research\appdata\local\microsoft\onedrive\onedrive.app.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010310Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.947{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.app.exe|69f6721f74b53fa9\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010311Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.947{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.app.exe|69f6721f74b53fa9\LinkDate05/22/2078 19:25:02NT AUTHORITY\SYSTEM 13241300x800000000000000010312Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.947{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.app.exe|69f6721f74b53fa9\BinProductVersion25.149.803.3NT AUTHORITY\SYSTEM 13241300x800000000000000010313Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:38.959{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivestandalo|965144bf68b790e0\LowerCaseLongPathc:\users\research\appdata\local\microsoft\onedrive\onedrivestandaloneupdater.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010314Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:38.959{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivestandalo|965144bf68b790e0\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010315Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:38.959{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivestandalo|965144bf68b790e0\LinkDate04/22/2056 15:38:40NT AUTHORITY\SYSTEM 13241300x800000000000000010316Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:38.959{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivestandalo|965144bf68b790e0\BinProductVersion25.149.803.3NT AUTHORITY\SYSTEM 13241300x800000000000000010317Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:39.109{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|a62d662e21b3abe1\LowerCaseLongPathc:\users\research\appdata\local\microsoft\onedrive\standaloneupdater\onedrivesetup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010318Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:39.109{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|a62d662e21b3abe1\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010319Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:39.109{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|a62d662e21b3abe1\LinkDate08/03/2002 22:58:27NT AUTHORITY\SYSTEM 13241300x800000000000000010320Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:39.109{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|a62d662e21b3abe1\BinProductVersion25.149.803.3NT AUTHORITY\SYSTEM 13241300x800000000000000010321Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.740{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\aggregatorhost.e|2f15385328865347\LowerCaseLongPathc:\windows\system32\aggregatorhost.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010322Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.740{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\aggregatorhost.e|2f15385328865347\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010323Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.740{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\aggregatorhost.e|2f15385328865347\LinkDate04/06/2090 19:15:20NT AUTHORITY\SYSTEM 13241300x800000000000000010324Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.740{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\aggregatorhost.e|2f15385328865347\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010325Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\appidcertstorech|dbcf03fbca94fe20\LowerCaseLongPathc:\windows\system32\appidcertstorecheck.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010326Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\appidcertstorech|dbcf03fbca94fe20\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010327Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\appidcertstorech|dbcf03fbca94fe20\LinkDate01/31/2001 14:20:32NT AUTHORITY\SYSTEM 13241300x800000000000000010328Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\appidcertstorech|dbcf03fbca94fe20\BinProductVersion10.0.26100.3037NT AUTHORITY\SYSTEM 13241300x800000000000000010329Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\appidpolicyconve|f05966cc1fbd40ed\LowerCaseLongPathc:\windows\system32\appidpolicyconverter.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010330Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\appidpolicyconve|f05966cc1fbd40ed\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010331Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\appidpolicyconve|f05966cc1fbd40ed\LinkDate08/21/2073 00:18:38NT AUTHORITY\SYSTEM 13241300x800000000000000010332Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\appidpolicyconve|f05966cc1fbd40ed\BinProductVersion10.0.26100.3037NT AUTHORITY\SYSTEM 13241300x800000000000000010333Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\applicationframe|7c5c9be1b612bbd\LowerCaseLongPathc:\windows\system32\applicationframehost.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010334Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\applicationframe|7c5c9be1b612bbd\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010335Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\applicationframe|7c5c9be1b612bbd\LinkDate12/13/2008 13:36:13NT AUTHORITY\SYSTEM 13241300x800000000000000010336Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.746{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\applicationframe|7c5c9be1b612bbd\BinProductVersion10.0.26100.3912NT AUTHORITY\SYSTEM 13241300x800000000000000010337Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.755{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\auditpol.exe|f1ca5494fc506771\LowerCaseLongPathc:\windows\syswow64\auditpol.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010338Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.755{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\auditpol.exe|f1ca5494fc506771\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010339Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.755{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\auditpol.exe|f1ca5494fc506771\LinkDate06/16/2015 02:50:02NT AUTHORITY\SYSTEM 13241300x800000000000000010340Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.755{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\auditpol.exe|f1ca5494fc506771\BinProductVersion10.0.26100.3037NT AUTHORITY\SYSTEM 13241300x800000000000000010341Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.774{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\certutil.exe|ac23a913bfcd42f0\LowerCaseLongPathc:\windows\syswow64\certutil.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010342Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.774{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\certutil.exe|ac23a913bfcd42f0\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010343Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.774{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\certutil.exe|ac23a913bfcd42f0\LinkDate08/22/1997 19:36:25NT AUTHORITY\SYSTEM 13241300x800000000000000010344Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.774{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\certutil.exe|ac23a913bfcd42f0\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010345Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.777{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\chrome.exe|84040b46ffb049b9\LowerCaseLongPathc:\program files\google\chrome\application\chrome.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010346Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.777{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\chrome.exe|84040b46ffb049b9\Publishergoogle llcNT AUTHORITY\SYSTEM 13241300x800000000000000010347Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.777{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\chrome.exe|84040b46ffb049b9\LinkDate11/11/2024 20:36:39NT AUTHORITY\SYSTEM 13241300x800000000000000010348Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.777{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\chrome.exe|84040b46ffb049b9\BinProductVersion131.0.6778.70NT AUTHORITY\SYSTEM 13241300x800000000000000010349Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.787{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cleanmgr.exe|42343e2ceb471480\LowerCaseLongPathc:\windows\system32\cleanmgr.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010350Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.787{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cleanmgr.exe|42343e2ceb471480\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010351Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.787{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cleanmgr.exe|42343e2ceb471480\LinkDate11/22/2090 09:21:20NT AUTHORITY\SYSTEM 13241300x800000000000000010352Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.787{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cleanmgr.exe|42343e2ceb471480\BinProductVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010353Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.787{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\clipup.exe|91e319793a480caa\LowerCaseLongPathc:\windows\system32\clipup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010354Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.787{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\clipup.exe|91e319793a480caa\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010355Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.787{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\clipup.exe|91e319793a480caa\LinkDate04/11/2082 13:12:21NT AUTHORITY\SYSTEM 13241300x800000000000000010356Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.787{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\clipup.exe|91e319793a480caa\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010357Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.798{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cmd.exe|5ce9ba8d0d54ad10\LowerCaseLongPathc:\windows\system32\cmd.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010358Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.798{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cmd.exe|5ce9ba8d0d54ad10\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010359Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.798{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cmd.exe|5ce9ba8d0d54ad10\LinkDate03/11/2103 17:39:08NT AUTHORITY\SYSTEM 13241300x800000000000000010360Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.798{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cmd.exe|5ce9ba8d0d54ad10\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010361Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.802{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cmd.exe|c8de35b73d56cdba\LowerCaseLongPathc:\windows\syswow64\cmd.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010362Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.802{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cmd.exe|c8de35b73d56cdba\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010363Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.802{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cmd.exe|c8de35b73d56cdba\LinkDate05/01/2056 20:22:00NT AUTHORITY\SYSTEM 13241300x800000000000000010364Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.802{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cmd.exe|c8de35b73d56cdba\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010365Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.805{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\compattelrunner.|732ad1627e12cb48\LowerCaseLongPathc:\windows\system32\compattelrunner.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010366Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.805{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\compattelrunner.|732ad1627e12cb48\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010367Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.805{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\compattelrunner.|732ad1627e12cb48\LinkDate02/27/2023 06:03:30NT AUTHORITY\SYSTEM 13241300x800000000000000010368Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.805{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\compattelrunner.|732ad1627e12cb48\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010369Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.807{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\conhost.exe|a73bcd1ef9353f3e\LowerCaseLongPathc:\windows\system32\conhost.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010370Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.807{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\conhost.exe|a73bcd1ef9353f3e\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010371Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.807{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\conhost.exe|a73bcd1ef9353f3e\LinkDate04/20/2101 00:07:44NT AUTHORITY\SYSTEM 13241300x800000000000000010372Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.807{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\conhost.exe|a73bcd1ef9353f3e\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010373Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.807{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\consent.exe|808393f799959da6\LowerCaseLongPathc:\windows\system32\consent.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010374Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.807{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\consent.exe|808393f799959da6\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010375Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.807{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\consent.exe|808393f799959da6\LinkDate01/09/2049 05:57:50NT AUTHORITY\SYSTEM 13241300x800000000000000010376Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.807{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\consent.exe|808393f799959da6\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010377Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.818{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\control.exe|ad3e7d6cb5424ec4\LowerCaseLongPathc:\windows\system32\control.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010378Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.818{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\control.exe|ad3e7d6cb5424ec4\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010379Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.818{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\control.exe|ad3e7d6cb5424ec4\LinkDate07/05/2055 18:09:59NT AUTHORITY\SYSTEM 13241300x800000000000000010380Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.818{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\control.exe|ad3e7d6cb5424ec4\BinProductVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010381Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\credentialuibrok|f2701fbf367d4b09\LowerCaseLongPathc:\windows\system32\credentialuibroker.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010382Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\credentialuibrok|f2701fbf367d4b09\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010383Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\credentialuibrok|f2701fbf367d4b09\LinkDate01/21/2100 00:15:50NT AUTHORITY\SYSTEM 13241300x800000000000000010384Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\credentialuibrok|f2701fbf367d4b09\BinProductVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010385Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cscript.exe|e9de8f8b8834a501\LowerCaseLongPathc:\windows\system32\cscript.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010386Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cscript.exe|e9de8f8b8834a501\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010387Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cscript.exe|e9de8f8b8834a501\LinkDate09/27/2094 20:01:30NT AUTHORITY\SYSTEM 13241300x800000000000000010388Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\cscript.exe|e9de8f8b8834a501\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010389Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ctfmon.exe|b5157a66388d511f\LowerCaseLongPathc:\windows\system32\ctfmon.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010390Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ctfmon.exe|b5157a66388d511f\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010391Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ctfmon.exe|b5157a66388d511f\LinkDate10/12/2033 08:19:25NT AUTHORITY\SYSTEM 13241300x800000000000000010392Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.834{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ctfmon.exe|b5157a66388d511f\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010393Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.850{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\defrag.exe|ebd85d04fc6a26d\LowerCaseLongPathc:\windows\system32\defrag.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010394Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.850{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\defrag.exe|ebd85d04fc6a26d\Publishermicrosoft corp.NT AUTHORITY\SYSTEM 13241300x800000000000000010395Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.850{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\defrag.exe|ebd85d04fc6a26d\LinkDate12/28/2046 02:39:46NT AUTHORITY\SYSTEM 13241300x800000000000000010396Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.850{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\defrag.exe|ebd85d04fc6a26d\BinProductVersion10.0.26100.1150NT AUTHORITY\SYSTEM 13241300x800000000000000010397Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\devicecensus.exe|26420fddf94319b3\LowerCaseLongPathc:\windows\system32\devicecensus.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010398Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\devicecensus.exe|26420fddf94319b3\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010399Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\devicecensus.exe|26420fddf94319b3\LinkDate03/20/2091 05:57:48NT AUTHORITY\SYSTEM 13241300x800000000000000010400Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\devicecensus.exe|26420fddf94319b3\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010401Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dfrgui.exe|aa057181f3eefff\LowerCaseLongPathc:\windows\system32\dfrgui.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010402Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dfrgui.exe|aa057181f3eefff\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010403Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dfrgui.exe|aa057181f3eefff\LinkDate06/30/1984 13:52:48NT AUTHORITY\SYSTEM 13241300x800000000000000010404Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dfrgui.exe|aa057181f3eefff\BinProductVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000010405Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\directxdatabaseu|6ebe7baa2801b4ff\LowerCaseLongPathc:\windows\system32\directxdatabaseupdater.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010406Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\directxdatabaseu|6ebe7baa2801b4ff\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010407Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\directxdatabaseu|6ebe7baa2801b4ff\LinkDate11/09/1988 16:18:45NT AUTHORITY\SYSTEM 13241300x800000000000000010408Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.858{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\directxdatabaseu|6ebe7baa2801b4ff\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010409Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dllhost.exe|5fa851ba539d9a3\LowerCaseLongPathc:\windows\system32\dllhost.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010410Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dllhost.exe|5fa851ba539d9a3\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010411Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dllhost.exe|5fa851ba539d9a3\LinkDate01/02/2064 08:07:22NT AUTHORITY\SYSTEM 13241300x800000000000000010412Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dllhost.exe|5fa851ba539d9a3\BinProductVersion10.0.26100.1150NT AUTHORITY\SYSTEM 13241300x800000000000000010413Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dmclient.exe|9723e031916d775c\LowerCaseLongPathc:\windows\system32\dmclient.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010414Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dmclient.exe|9723e031916d775c\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010415Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dmclient.exe|9723e031916d775c\LinkDate03/03/2070 05:07:06NT AUTHORITY\SYSTEM 13241300x800000000000000010416Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dmclient.exe|9723e031916d775c\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010417Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\drvinst.exe|aa32db6491e404e1\LowerCaseLongPathc:\windows\system32\drvinst.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010418Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\drvinst.exe|aa32db6491e404e1\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010419Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\drvinst.exe|aa32db6491e404e1\LinkDate11/14/2067 03:35:03NT AUTHORITY\SYSTEM 13241300x800000000000000010420Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.866{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\drvinst.exe|aa32db6491e404e1\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010421Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.881{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dwm.exe|f848a80c6540ffad\LowerCaseLongPathc:\windows\system32\dwm.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010422Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.881{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dwm.exe|f848a80c6540ffad\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010423Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.881{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dwm.exe|f848a80c6540ffad\LinkDate08/20/2068 21:01:52NT AUTHORITY\SYSTEM 13241300x800000000000000010424Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.881{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\dwm.exe|f848a80c6540ffad\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010425Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.881{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|9ec28976970817d4\LowerCaseLongPathc:\program files\google\chrome\application\131.0.6778.70\elevation_service.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010426Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.881{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|9ec28976970817d4\Publishergoogle llcNT AUTHORITY\SYSTEM 13241300x800000000000000010427Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.881{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|9ec28976970817d4\LinkDate11/11/2024 20:36:39NT AUTHORITY\SYSTEM 13241300x800000000000000010428Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.881{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\elevation_servic|9ec28976970817d4\BinProductVersion131.0.6778.70NT AUTHORITY\SYSTEM 13241300x800000000000000010429Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.897{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\explorer.exe|68e882542b88f3ee\LowerCaseLongPathc:\windows\explorer.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010430Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.897{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\explorer.exe|68e882542b88f3ee\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010431Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.897{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\explorer.exe|68e882542b88f3ee\LinkDate07/22/2070 20:59:49NT AUTHORITY\SYSTEM 13241300x800000000000000010432Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.897{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\explorer.exe|68e882542b88f3ee\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010433Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.928{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie4uinit.exe|874b2700383dd346\LowerCaseLongPathc:\windows\system32\ie4uinit.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010434Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.928{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie4uinit.exe|874b2700383dd346\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010435Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.928{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie4uinit.exe|874b2700383dd346\LinkDate12/31/2073 18:54:15NT AUTHORITY\SYSTEM 13241300x800000000000000010436Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.928{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ie4uinit.exe|874b2700383dd346\BinProductVersion11.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010437Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.933{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\javaws.exe|f967368f6d803cca\LowerCaseLongPathc:\program files (x86)\java\jre1.8.0_431\bin\javaws.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010438Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.933{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\javaws.exe|f967368f6d803cca\Publisheroracle corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010439Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.933{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\javaws.exe|f967368f6d803cca\LinkDate09/30/2024 08:20:31NT AUTHORITY\SYSTEM 13241300x800000000000000010440Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.933{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\javaws.exe|f967368f6d803cca\BinProductVersion8.0.4310.10NT AUTHORITY\SYSTEM 13241300x800000000000000010441Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.938{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jp2launcher.exe|172422e15416b5d9\LowerCaseLongPathc:\program files (x86)\java\jre1.8.0_431\bin\jp2launcher.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010442Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.938{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jp2launcher.exe|172422e15416b5d9\Publisheroracle corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010443Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.938{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jp2launcher.exe|172422e15416b5d9\LinkDate09/30/2024 08:22:34NT AUTHORITY\SYSTEM 13241300x800000000000000010444Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.938{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jp2launcher.exe|172422e15416b5d9\BinProductVersion8.0.4310.10NT AUTHORITY\SYSTEM 13241300x800000000000000010445Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.940{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jucheck.exe|374f57912ab1ba39\LowerCaseLongPathc:\program files (x86)\common files\java\java update\jucheck.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010446Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.940{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jucheck.exe|374f57912ab1ba39\Publisheroracle corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010447Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.940{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jucheck.exe|374f57912ab1ba39\LinkDate09/30/2024 08:47:48NT AUTHORITY\SYSTEM 13241300x800000000000000010448Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.940{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jucheck.exe|374f57912ab1ba39\BinProductVersion2.8.431.10NT AUTHORITY\SYSTEM 13241300x800000000000000010449Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.942{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jusched.exe|15b7407a86c6042f\LowerCaseLongPathc:\program files (x86)\common files\java\java update\jusched.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010450Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.942{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jusched.exe|15b7407a86c6042f\Publisheroracle corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010451Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.942{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jusched.exe|15b7407a86c6042f\LinkDate09/30/2024 08:47:57NT AUTHORITY\SYSTEM 13241300x800000000000000010452Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.942{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\jusched.exe|15b7407a86c6042f\BinProductVersion2.8.431.10NT AUTHORITY\SYSTEM 13241300x800000000000000010453Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.944{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\logonui.exe|abe25f7310ce82cc\LowerCaseLongPathc:\windows\system32\logonui.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010454Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.944{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\logonui.exe|abe25f7310ce82cc\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010455Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.944{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\logonui.exe|abe25f7310ce82cc\LinkDate04/26/2087 22:47:56NT AUTHORITY\SYSTEM 13241300x800000000000000010456Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.944{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\logonui.exe|abe25f7310ce82cc\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010457Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.944{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lpremove.exe|5b4b864d8514e716\LowerCaseLongPathc:\windows\system32\lpremove.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010458Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.944{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lpremove.exe|5b4b864d8514e716\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010459Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.944{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lpremove.exe|5b4b864d8514e716\LinkDate03/27/2085 03:42:05NT AUTHORITY\SYSTEM 13241300x800000000000000010460Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.944{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lpremove.exe|5b4b864d8514e716\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010461Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.961{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mcbuilder.exe|fa2995f98d7b162b\LowerCaseLongPathc:\windows\system32\mcbuilder.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010462Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.961{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mcbuilder.exe|fa2995f98d7b162b\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010463Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.961{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mcbuilder.exe|fa2995f98d7b162b\LinkDate02/23/1973 10:27:17NT AUTHORITY\SYSTEM 13241300x800000000000000010464Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.961{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mcbuilder.exe|fa2995f98d7b162b\BinProductVersion10.0.26100.3037NT AUTHORITY\SYSTEM 13241300x800000000000000010465Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.963{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mdmdiagnosticsto|50a6376a93e56677\LowerCaseLongPathc:\windows\system32\mdmdiagnosticstool.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010466Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.963{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mdmdiagnosticsto|50a6376a93e56677\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010467Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.965{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mdmdiagnosticsto|50a6376a93e56677\LinkDate07/27/2092 13:07:57NT AUTHORITY\SYSTEM 13241300x800000000000000010468Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.965{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mdmdiagnosticsto|50a6376a93e56677\BinProductVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000010469Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.969{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|84bcd64699b11da4\LowerCaseLongPathc:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010470Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.969{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|84bcd64699b11da4\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010471Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.969{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|84bcd64699b11da4\LinkDate03/21/2024 21:25:50NT AUTHORITY\SYSTEM 13241300x800000000000000010472Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.969{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\microsoftedgeupd|84bcd64699b11da4\BinProductVersion1.3.185.27NT AUTHORITY\SYSTEM 13241300x800000000000000010473Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.993{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mmc.exe|8471611706ce450b\LowerCaseLongPathc:\windows\system32\mmc.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010474Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.993{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mmc.exe|8471611706ce450b\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010475Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.993{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mmc.exe|8471611706ce450b\LinkDate03/01/2037 03:26:12NT AUTHORITY\SYSTEM 13241300x800000000000000010476Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.993{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mmc.exe|8471611706ce450b\BinProductVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010477Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:40.995{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mofcomp.exe|862f05ca56b37f77\LowerCaseLongPathc:\windows\system32\wbem\mofcomp.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010478Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:40.995{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mofcomp.exe|862f05ca56b37f77\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010479Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:40.995{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mofcomp.exe|862f05ca56b37f77\LinkDate11/18/2092 14:42:35NT AUTHORITY\SYSTEM 13241300x800000000000000010480Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:40.995{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mofcomp.exe|862f05ca56b37f77\BinProductVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010481Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.005{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\monotificationux|985a11634d51ae37\LowerCaseLongPathc:\windows\uus\amd64\monotificationux.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010482Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.005{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\monotificationux|985a11634d51ae37\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010483Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.005{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\monotificationux|985a11634d51ae37\LinkDate04/17/2006 00:32:18NT AUTHORITY\SYSTEM 13241300x800000000000000010484Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.005{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\monotificationux|985a11634d51ae37\BinProductVersion1350.2506.29012.0NT AUTHORITY\SYSTEM 13241300x800000000000000010485Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.015{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mousocoreworker.|a1b2c6de99d06de6\LowerCaseLongPathc:\windows\uus\amd64\mousocoreworker.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010486Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.015{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mousocoreworker.|a1b2c6de99d06de6\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010487Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.015{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mousocoreworker.|a1b2c6de99d06de6\LinkDate10/04/2046 14:29:17NT AUTHORITY\SYSTEM 13241300x800000000000000010488Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.015{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mousocoreworker.|a1b2c6de99d06de6\BinProductVersion1350.2506.29012.0NT AUTHORITY\SYSTEM 13241300x800000000000000010489Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.021{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpcmdrun.exe|2a14566f87e51e5\LowerCaseLongPathc:\programdata\microsoft\windows defender\platform\4.18.25080.5-0\mpcmdrun.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010490Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.021{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpcmdrun.exe|2a14566f87e51e5\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010491Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.021{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpcmdrun.exe|2a14566f87e51e5\LinkDate11/15/2043 18:59:39NT AUTHORITY\SYSTEM 13241300x800000000000000010492Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.021{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpcmdrun.exe|2a14566f87e51e5\BinProductVersion4.18.25080.5NT AUTHORITY\SYSTEM 13241300x800000000000000010493Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.027{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpdefendercorese|e169abd4e8e39d43\LowerCaseLongPathc:\programdata\microsoft\windows defender\platform\4.18.25080.5-0\mpdefendercoreservice.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010494Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.027{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpdefendercorese|e169abd4e8e39d43\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010495Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.027{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpdefendercorese|e169abd4e8e39d43\LinkDate04/26/2046 18:38:33NT AUTHORITY\SYSTEM 13241300x800000000000000010496Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.027{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpdefendercorese|e169abd4e8e39d43\BinProductVersion4.18.25080.5NT AUTHORITY\SYSTEM 13241300x800000000000000010497Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.043{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|d27b57360cd4a4cf\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\msedge.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010498Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.043{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|d27b57360cd4a4cf\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010499Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.043{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|d27b57360cd4a4cf\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010500Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.043{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|d27b57360cd4a4cf\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010501Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.045{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|d27b57360cd4a4cf\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\msedge.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010502Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.045{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|d27b57360cd4a4cf\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010503Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.045{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|d27b57360cd4a4cf\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010504Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.045{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge.exe|d27b57360cd4a4cf\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010505Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.054{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|4ee55cb70447a0c6\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\msedge_proxy.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010506Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.054{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|4ee55cb70447a0c6\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010507Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.054{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|4ee55cb70447a0c6\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010508Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.054{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|4ee55cb70447a0c6\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010509Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.055{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|4ee55cb70447a0c6\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\msedge_proxy.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010510Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.055{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|4ee55cb70447a0c6\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010511Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.055{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|4ee55cb70447a0c6\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010512Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.055{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msedge_proxy.exe|4ee55cb70447a0c6\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010513Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.063{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msmpeng.exe|2db839252ddacb8c\LowerCaseLongPathc:\programdata\microsoft\windows defender\platform\4.18.25080.5-0\msmpeng.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010514Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.063{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msmpeng.exe|2db839252ddacb8c\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010515Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.063{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msmpeng.exe|2db839252ddacb8c\LinkDate03/29/2074 23:58:28NT AUTHORITY\SYSTEM 13241300x800000000000000010516Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.063{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msmpeng.exe|2db839252ddacb8c\BinProductVersion4.18.25080.5NT AUTHORITY\SYSTEM 13241300x800000000000000010517Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msoobe.exe|d79e10f510d8bba1\LowerCaseLongPathc:\windows\system32\oobe\msoobe.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010518Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msoobe.exe|d79e10f510d8bba1\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010519Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msoobe.exe|d79e10f510d8bba1\LinkDate12/22/2031 20:31:15NT AUTHORITY\SYSTEM 13241300x800000000000000010520Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msoobe.exe|d79e10f510d8bba1\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010521Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\net.exe|67bf6d4cbb6a25ae\LowerCaseLongPathc:\windows\system32\net.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010522Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\net.exe|67bf6d4cbb6a25ae\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010523Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\net.exe|67bf6d4cbb6a25ae\LinkDate02/26/2031 05:10:39NT AUTHORITY\SYSTEM 13241300x800000000000000010524Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\net.exe|67bf6d4cbb6a25ae\BinProductVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010525Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\net.exe|c8c8e31753eb69cb\LowerCaseLongPathc:\windows\syswow64\net.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010526Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\net.exe|c8c8e31753eb69cb\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010527Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\net.exe|c8c8e31753eb69cb\LinkDate11/23/2033 14:57:00NT AUTHORITY\SYSTEM 13241300x800000000000000010528Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.071{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\net.exe|c8c8e31753eb69cb\BinProductVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010529Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.087{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netsh.exe|d999f403d2627a1d\LowerCaseLongPathc:\windows\syswow64\netsh.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010530Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.087{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netsh.exe|d999f403d2627a1d\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010531Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.087{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netsh.exe|d999f403d2627a1d\LinkDate10/08/2086 10:36:51NT AUTHORITY\SYSTEM 13241300x800000000000000010532Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.087{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netsh.exe|d999f403d2627a1d\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010533Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netstat.exe|ce8db1f5bbf4e72d\LowerCaseLongPathc:\windows\system32\netstat.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010534Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netstat.exe|ce8db1f5bbf4e72d\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010535Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netstat.exe|ce8db1f5bbf4e72d\LinkDate10/19/2037 22:49:14NT AUTHORITY\SYSTEM 13241300x800000000000000010536Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\netstat.exe|ce8db1f5bbf4e72d\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010537Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngen.exe|4653055c63a37b02\LowerCaseLongPathc:\windows\microsoft.net\framework\v4.0.30319\ngen.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010538Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngen.exe|4653055c63a37b02\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010539Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngen.exe|4653055c63a37b02\LinkDate06/08/2022 23:18:30NT AUTHORITY\SYSTEM 13241300x800000000000000010540Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngen.exe|4653055c63a37b02\BinProductVersion4.0.30319.0NT AUTHORITY\SYSTEM 13241300x800000000000000010541Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngen.exe|6737a0e56950a135\LowerCaseLongPathc:\windows\microsoft.net\framework64\v4.0.30319\ngen.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010542Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngen.exe|6737a0e56950a135\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010543Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngen.exe|6737a0e56950a135\LinkDate06/08/2022 23:15:17NT AUTHORITY\SYSTEM 13241300x800000000000000010544Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.089{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngen.exe|6737a0e56950a135\BinProductVersion4.0.30319.0NT AUTHORITY\SYSTEM 13241300x800000000000000010545Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngentask.exe|5c7d7da84d53b8ea\LowerCaseLongPathc:\windows\microsoft.net\framework64\v4.0.30319\ngentask.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010546Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngentask.exe|5c7d7da84d53b8ea\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010547Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngentask.exe|5c7d7da84d53b8ea\LinkDate04/08/2022 21:27:51NT AUTHORITY\SYSTEM 13241300x800000000000000010548Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngentask.exe|5c7d7da84d53b8ea\BinProductVersion4.0.30319.0NT AUTHORITY\SYSTEM 13241300x800000000000000010549Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngentask.exe|cc6494267adfb0bb\LowerCaseLongPathc:\windows\microsoft.net\framework\v4.0.30319\ngentask.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010550Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngentask.exe|cc6494267adfb0bb\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010551Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngentask.exe|cc6494267adfb0bb\LinkDate04/08/2022 21:24:38NT AUTHORITY\SYSTEM 13241300x800000000000000010552Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ngentask.exe|cc6494267adfb0bb\BinProductVersion4.0.30319.0NT AUTHORITY\SYSTEM 13241300x800000000000000010553Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\nissrv.exe|e44817fc5f9bfd11\LowerCaseLongPathc:\programdata\microsoft\windows defender\platform\4.18.25080.5-0\nissrv.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010554Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\nissrv.exe|e44817fc5f9bfd11\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010555Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\nissrv.exe|e44817fc5f9bfd11\LinkDate09/07/2021 06:49:53NT AUTHORITY\SYSTEM 13241300x800000000000000010556Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.103{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\nissrv.exe|e44817fc5f9bfd11\BinProductVersion4.18.25080.5NT AUTHORITY\SYSTEM 13241300x800000000000000010557Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.149{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollama app.exe|2e2d731f79f6e479\LowerCaseLongPathc:\users\administrator\appdata\local\programs\ollama\ollama app.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010558Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.149{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollama app.exe|2e2d731f79f6e479\LinkDate01/01/1970 00:00:00NT AUTHORITY\SYSTEM 13241300x800000000000000010559Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.151{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollama app.exe|2e2d731f79f6e479\LowerCaseLongPathc:\users\administrator\appdata\local\programs\ollama\ollama app.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010560Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.151{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollama app.exe|2e2d731f79f6e479\LinkDate01/01/1970 00:00:00NT AUTHORITY\SYSTEM 13241300x800000000000000010561Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.204{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollama.exe|a249c2f0bb4acc5c\LowerCaseLongPathc:\users\administrator\appdata\local\programs\ollama\ollama.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010562Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.204{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollama.exe|a249c2f0bb4acc5c\LinkDate01/01/1970 00:00:00NT AUTHORITY\SYSTEM 13241300x800000000000000010563Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.208{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollama.exe|a249c2f0bb4acc5c\LowerCaseLongPathc:\users\administrator\appdata\local\programs\ollama\ollama.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010564Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.208{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ollama.exe|a249c2f0bb4acc5c\LinkDate01/01/1970 00:00:00NT AUTHORITY\SYSTEM 13241300x800000000000000010565Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.218{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.exe|f265da245d771f66\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\onedrive.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010566Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.218{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.exe|f265da245d771f66\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010567Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.218{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.exe|f265da245d771f66\LinkDate10/01/2042 17:33:15NT AUTHORITY\SYSTEM 13241300x800000000000000010568Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.218{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrive.exe|f265da245d771f66\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010569Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.264{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|d3f263bd663e4335\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\update\onedrivesetup.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010570Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.264{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|d3f263bd663e4335\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010571Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.264{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|d3f263bd663e4335\LinkDate11/28/2034 23:04:51NT AUTHORITY\SYSTEM 13241300x800000000000000010572Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.264{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivesetup.ex|d3f263bd663e4335\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010573Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.278{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivestandalo|2d3dc867bcc2e4ec\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\onedrivestandaloneupdater.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010574Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.278{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivestandalo|2d3dc867bcc2e4ec\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010575Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.278{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivestandalo|2d3dc867bcc2e4ec\LinkDate09/04/2091 19:21:58NT AUTHORITY\SYSTEM 13241300x800000000000000010576Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.278{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\onedrivestandalo|2d3dc867bcc2e4ec\BinProductVersion25.189.928.2NT AUTHORITY\SYSTEM 13241300x800000000000000010577Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.297{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\openconsole.exe|7523323d8bd56d99\LowerCaseLongPathc:\program files\windowsapps\microsoft.windowsterminal_1.22.12111.0_x64__8wekyb3d8bbwe\openconsole.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010578Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.297{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\openconsole.exe|7523323d8bd56d99\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010579Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.297{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\openconsole.exe|7523323d8bd56d99\LinkDate07/30/2025 17:23:48NT AUTHORITY\SYSTEM 13241300x800000000000000010580Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.297{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\openconsole.exe|7523323d8bd56d99\BinProductVersion1.22.2507.30001NT AUTHORITY\SYSTEM 13241300x800000000000000010581Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.301{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\openwith.exe|5c91e48dda5e9a2a\LowerCaseLongPathc:\windows\system32\openwith.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010582Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.301{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\openwith.exe|5c91e48dda5e9a2a\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010583Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.301{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\openwith.exe|5c91e48dda5e9a2a\LinkDate06/04/2000 00:25:21NT AUTHORITY\SYSTEM 13241300x800000000000000010584Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.301{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\openwith.exe|5c91e48dda5e9a2a\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010585Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.342{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\osqueryd.exe|9babb64fb6dcf9f9\LowerCaseLongPathc:\program files\osquery\osqueryd\osqueryd.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010586Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.342{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\osqueryd.exe|9babb64fb6dcf9f9\Publisherosquery foundationNT AUTHORITY\SYSTEM 13241300x800000000000000010587Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.342{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\osqueryd.exe|9babb64fb6dcf9f9\LinkDate12/27/2023 23:22:56NT AUTHORITY\SYSTEM 13241300x800000000000000010588Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.342{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\osqueryd.exe|9babb64fb6dcf9f9\BinProductVersion5.11.0.0NT AUTHORITY\SYSTEM 13241300x800000000000000010589Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.358{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pickerhost.exe|3b85f25a872af81a\LowerCaseLongPathc:\windows\system32\pickerhost.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010590Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.358{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pickerhost.exe|3b85f25a872af81a\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010591Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.358{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pickerhost.exe|3b85f25a872af81a\LinkDate03/19/2050 17:12:11NT AUTHORITY\SYSTEM 13241300x800000000000000010592Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.358{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pickerhost.exe|3b85f25a872af81a\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010593Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.358{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pnputil.exe|987679f36a34f0f3\LowerCaseLongPathc:\windows\system32\pnputil.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010594Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.358{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pnputil.exe|987679f36a34f0f3\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010595Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.358{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pnputil.exe|987679f36a34f0f3\LinkDate04/06/1996 11:37:56NT AUTHORITY\SYSTEM 13241300x800000000000000010596Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.358{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pnputil.exe|987679f36a34f0f3\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010597Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.379{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2\LowerCaseLongPathc:\windows\system32\windowspowershell\v1.0\powershell.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010598Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.379{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010599Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.379{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2\LinkDate01/28/2029 07:58:40NT AUTHORITY\SYSTEM 13241300x800000000000000010600Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.379{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2\BinProductVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000010601Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.381{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\powershell.exe|bdbb2c1d41b249e7\LowerCaseLongPathc:\windows\syswow64\windowspowershell\v1.0\powershell.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010602Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.381{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\powershell.exe|bdbb2c1d41b249e7\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010603Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.381{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\powershell.exe|bdbb2c1d41b249e7\LinkDate05/10/2004 17:56:54NT AUTHORITY\SYSTEM 13241300x800000000000000010604Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.381{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\powershell.exe|bdbb2c1d41b249e7\BinProductVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000010605Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.389{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|20bf7484dcde13ee\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\pwahelper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010606Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.389{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|20bf7484dcde13ee\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010607Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.389{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|20bf7484dcde13ee\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010608Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.389{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|20bf7484dcde13ee\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010609Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.389{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|20bf7484dcde13ee\LowerCaseLongPathc:\program files (x86)\microsoft\edge\application\pwahelper.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010610Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.389{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|20bf7484dcde13ee\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010611Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.389{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|20bf7484dcde13ee\LinkDate10/22/2025 21:13:40NT AUTHORITY\SYSTEM 13241300x800000000000000010612Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.389{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\pwahelper.exe|20bf7484dcde13ee\BinProductVersion141.0.3537.99NT AUTHORITY\SYSTEM 13241300x800000000000000010613Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.405{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\reg.exe|83f32596acff4023\LowerCaseLongPathc:\windows\system32\reg.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010614Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.405{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\reg.exe|83f32596acff4023\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010615Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.405{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\reg.exe|83f32596acff4023\LinkDate02/01/2102 17:04:30NT AUTHORITY\SYSTEM 13241300x800000000000000010616Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.405{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\reg.exe|83f32596acff4023\BinProductVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010617Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.408{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\reg.exe|dae4008c3ff6ffc0\LowerCaseLongPathc:\windows\syswow64\reg.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010618Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.408{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\reg.exe|dae4008c3ff6ffc0\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010619Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.408{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\reg.exe|dae4008c3ff6ffc0\LinkDate12/28/2080 21:53:06NT AUTHORITY\SYSTEM 13241300x800000000000000010620Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.408{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\reg.exe|dae4008c3ff6ffc0\BinProductVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010621Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.411{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\regedit.exe|cad7f90dbb3ce123\LowerCaseLongPathc:\windows\regedit.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010622Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.411{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\regedit.exe|cad7f90dbb3ce123\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010623Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.411{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\regedit.exe|cad7f90dbb3ce123\LinkDate10/11/2075 19:24:22NT AUTHORITY\SYSTEM 13241300x800000000000000010624Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.411{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\regedit.exe|cad7f90dbb3ce123\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010625Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.411{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081\LowerCaseLongPathc:\windows\syswow64\regsvr32.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010626Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.411{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010627Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.411{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081\LinkDate07/13/2018 12:04:48NT AUTHORITY\SYSTEM 13241300x800000000000000010628Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.411{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010629Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LowerCaseLongPathc:\windows\system32\rundll32.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010630Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010631Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LinkDate06/28/1988 15:11:22NT AUTHORITY\SYSTEM 13241300x800000000000000010632Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinProductVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010633Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runonce.exe|112bcdfdacfed846\LowerCaseLongPathc:\windows\system32\runonce.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010634Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runonce.exe|112bcdfdacfed846\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010635Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runonce.exe|112bcdfdacfed846\LinkDate07/20/2001 18:10:17NT AUTHORITY\SYSTEM 13241300x800000000000000010636Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runonce.exe|112bcdfdacfed846\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010637Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runonce.exe|63eeaa8ac8c22e75\LowerCaseLongPathc:\windows\syswow64\runonce.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010638Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runonce.exe|63eeaa8ac8c22e75\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010639Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runonce.exe|63eeaa8ac8c22e75\LinkDate04/12/2043 01:54:20NT AUTHORITY\SYSTEM 13241300x800000000000000010640Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runonce.exe|63eeaa8ac8c22e75\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010641Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runtimebroker.ex|e0ee56ced61a9674\LowerCaseLongPathc:\windows\system32\runtimebroker.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010642Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runtimebroker.ex|e0ee56ced61a9674\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010643Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runtimebroker.ex|e0ee56ced61a9674\LinkDate08/24/2105 23:21:20NT AUTHORITY\SYSTEM 13241300x800000000000000010644Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\runtimebroker.ex|e0ee56ced61a9674\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010645Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sc.exe|f9557929d5a0fd7b\LowerCaseLongPathc:\windows\system32\sc.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010646Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sc.exe|f9557929d5a0fd7b\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010647Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sc.exe|f9557929d5a0fd7b\LinkDate08/14/2055 16:55:30NT AUTHORITY\SYSTEM 13241300x800000000000000010648Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sc.exe|f9557929d5a0fd7b\BinProductVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010649Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\schtasks.exe|d164abe84be90391\LowerCaseLongPathc:\windows\syswow64\schtasks.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010650Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\schtasks.exe|d164abe84be90391\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010651Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\schtasks.exe|d164abe84be90391\LinkDate10/14/1978 07:56:28NT AUTHORITY\SYSTEM 13241300x800000000000000010652Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.421{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\schtasks.exe|d164abe84be90391\BinProductVersion10.0.26100.4343NT AUTHORITY\SYSTEM 13241300x800000000000000010653Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sdbinst.exe|abd8eadcb53d1cf9\LowerCaseLongPathc:\windows\system32\sdbinst.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010654Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sdbinst.exe|abd8eadcb53d1cf9\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010655Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sdbinst.exe|abd8eadcb53d1cf9\LinkDate07/04/2084 01:53:36NT AUTHORITY\SYSTEM 13241300x800000000000000010656Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sdbinst.exe|abd8eadcb53d1cf9\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010657Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\searchindexer.ex|656ad2d8d06756c\LowerCaseLongPathc:\windows\system32\searchindexer.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010658Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\searchindexer.ex|656ad2d8d06756c\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010659Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\searchindexer.ex|656ad2d8d06756c\LinkDate03/08/1987 21:57:28NT AUTHORITY\SYSTEM 13241300x800000000000000010660Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\searchindexer.ex|656ad2d8d06756c\BinProductVersion7.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010661Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthho|2af635c7e213d024\LowerCaseLongPathc:\windows\system32\securityhealth\10.0.27840.1000-0\securityhealthhost.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010662Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthho|2af635c7e213d024\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010663Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthho|2af635c7e213d024\LinkDate04/30/1994 17:17:52NT AUTHORITY\SYSTEM 13241300x800000000000000010664Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthho|2af635c7e213d024\BinProductVersion10.0.27840.1000NT AUTHORITY\SYSTEM 13241300x800000000000000010665Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthho|73c10dabec8b1be5\LowerCaseLongPathc:\windows\system32\securityhealthhost.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010666Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthho|73c10dabec8b1be5\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010667Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthho|73c10dabec8b1be5\LinkDate09/24/2043 07:21:04NT AUTHORITY\SYSTEM 13241300x800000000000000010668Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthho|73c10dabec8b1be5\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010669Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthse|3a6d325b78a9c5bf\LowerCaseLongPathc:\windows\system32\securityhealthservice.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010670Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthse|3a6d325b78a9c5bf\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010671Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthse|3a6d325b78a9c5bf\LinkDate01/21/2058 12:35:10NT AUTHORITY\SYSTEM 13241300x800000000000000010672Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\securityhealthse|3a6d325b78a9c5bf\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010673Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\services.exe|a9f10120a5dfa066\LowerCaseLongPathc:\windows\system32\services.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010674Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\services.exe|a9f10120a5dfa066\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010675Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\services.exe|a9f10120a5dfa066\LinkDate02/27/2053 09:39:07NT AUTHORITY\SYSTEM 13241300x800000000000000010676Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.437{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\services.exe|a9f10120a5dfa066\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010677Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\shutdown.exe|e576d9990252c4ee\LowerCaseLongPathc:\windows\system32\shutdown.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010678Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\shutdown.exe|e576d9990252c4ee\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010679Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\shutdown.exe|e576d9990252c4ee\LinkDate06/11/2073 06:56:20NT AUTHORITY\SYSTEM 13241300x800000000000000010680Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\shutdown.exe|e576d9990252c4ee\BinProductVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000010681Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sihclient.exe|92e5ae7dc3f76efd\LowerCaseLongPathc:\windows\system32\sihclient.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010682Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sihclient.exe|92e5ae7dc3f76efd\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010683Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sihclient.exe|92e5ae7dc3f76efd\LinkDate06/09/2040 18:59:25NT AUTHORITY\SYSTEM 13241300x800000000000000010684Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sihclient.exe|92e5ae7dc3f76efd\BinProductVersion1350.2506.29012.0NT AUTHORITY\SYSTEM 13241300x800000000000000010685Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sihost.exe|b528ee4e5557944a\LowerCaseLongPathc:\windows\system32\sihost.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010686Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sihost.exe|b528ee4e5557944a\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010687Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sihost.exe|b528ee4e5557944a\LinkDate07/30/2093 20:21:16NT AUTHORITY\SYSTEM 13241300x800000000000000010688Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.453{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sihost.exe|b528ee4e5557944a\BinProductVersion10.0.26100.1882NT AUTHORITY\SYSTEM 13241300x800000000000000010689Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.469{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\smss.exe|e5f1e221aaf19079\LowerCaseLongPathc:\windows\system32\smss.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010690Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.469{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\smss.exe|e5f1e221aaf19079\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010691Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.469{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\smss.exe|e5f1e221aaf19079\LinkDate02/02/2016 08:18:51NT AUTHORITY\SYSTEM 13241300x800000000000000010692Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.469{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\smss.exe|e5f1e221aaf19079\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010693Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.469{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\spoolsv.exe|1bb2eb6a2f17a3d0\LowerCaseLongPathc:\windows\system32\spoolsv.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010694Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.469{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\spoolsv.exe|1bb2eb6a2f17a3d0\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010695Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.469{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\spoolsv.exe|1bb2eb6a2f17a3d0\LinkDate11/21/1995 12:35:54NT AUTHORITY\SYSTEM 13241300x800000000000000010696Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.469{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\spoolsv.exe|1bb2eb6a2f17a3d0\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010697Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.475{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sppextcomobj.exe|b05799c8b1eb4a3\LowerCaseLongPathc:\windows\system32\sppextcomobj.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010698Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.475{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sppextcomobj.exe|b05799c8b1eb4a3\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010699Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.475{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sppextcomobj.exe|b05799c8b1eb4a3\LinkDate05/29/2006 05:46:22NT AUTHORITY\SYSTEM 13241300x800000000000000010700Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.475{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\sppextcomobj.exe|b05799c8b1eb4a3\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010701Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.475{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\svchost.exe|3a3b9820ea882eb4\LowerCaseLongPathc:\windows\system32\svchost.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010702Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.475{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\svchost.exe|3a3b9820ea882eb4\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010703Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.475{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\svchost.exe|3a3b9820ea882eb4\LinkDate02/06/2054 15:19:25NT AUTHORITY\SYSTEM 13241300x800000000000000010704Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.475{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\svchost.exe|3a3b9820ea882eb4\BinProductVersion10.0.26100.4343NT AUTHORITY\SYSTEM 13241300x800000000000000010705Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.489{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\systemsettingsad|bf44aa5e9c15352\LowerCaseLongPathc:\windows\system32\systemsettingsadminflows.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010706Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.489{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\systemsettingsad|bf44aa5e9c15352\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010707Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.489{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\systemsettingsad|bf44aa5e9c15352\LinkDate06/20/2065 23:19:30NT AUTHORITY\SYSTEM 13241300x800000000000000010708Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.489{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\systemsettingsad|bf44aa5e9c15352\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010709Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.489{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskhostw.exe|87c6c7cdfdc02bad\LowerCaseLongPathc:\windows\system32\taskhostw.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010710Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.489{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskhostw.exe|87c6c7cdfdc02bad\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010711Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.489{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskhostw.exe|87c6c7cdfdc02bad\LinkDate07/12/2094 20:53:28NT AUTHORITY\SYSTEM 13241300x800000000000000010712Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.489{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskhostw.exe|87c6c7cdfdc02bad\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010713Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.491{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskkill.exe|48a632600af6cbf3\LowerCaseLongPathc:\windows\system32\taskkill.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010714Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.491{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskkill.exe|48a632600af6cbf3\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010715Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.491{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskkill.exe|48a632600af6cbf3\LinkDate07/25/2052 11:51:30NT AUTHORITY\SYSTEM 13241300x800000000000000010716Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.491{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskkill.exe|48a632600af6cbf3\BinProductVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000010717Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.501{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskmgr.exe|615e0fd2618692ec\LowerCaseLongPathc:\windows\system32\taskmgr.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010718Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.501{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskmgr.exe|615e0fd2618692ec\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010719Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.501{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskmgr.exe|615e0fd2618692ec\LinkDate06/25/2063 11:45:51NT AUTHORITY\SYSTEM 13241300x800000000000000010720Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.501{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\taskmgr.exe|615e0fd2618692ec\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010721Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.501{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\tiworker.exe|4088b8ca18215795\LowerCaseLongPathc:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.4933_none_a4edf32577775419\tiworker.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010722Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.501{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\tiworker.exe|4088b8ca18215795\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010723Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.501{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\tiworker.exe|4088b8ca18215795\LinkDate10/10/1972 16:19:04NT AUTHORITY\SYSTEM 13241300x800000000000000010724Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.501{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\tiworker.exe|4088b8ca18215795\BinProductVersion10.0.26100.4933NT AUTHORITY\SYSTEM 13241300x800000000000000010725Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.516{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\tzsync.exe|b7312a33f1aac703\LowerCaseLongPathc:\windows\system32\tzsync.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010726Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.516{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\tzsync.exe|b7312a33f1aac703\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010727Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.516{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\tzsync.exe|b7312a33f1aac703\LinkDate10/11/2078 11:17:25NT AUTHORITY\SYSTEM 13241300x800000000000000010728Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.516{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\tzsync.exe|b7312a33f1aac703\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010729Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.516{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ucpdmgr.exe|cf023fa141a0ffe7\LowerCaseLongPathc:\windows\system32\ucpdmgr.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010730Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.516{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ucpdmgr.exe|cf023fa141a0ffe7\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010731Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.516{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ucpdmgr.exe|cf023fa141a0ffe7\LinkDate08/28/1993 07:44:13NT AUTHORITY\SYSTEM 13241300x800000000000000010732Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.516{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\ucpdmgr.exe|cf023fa141a0ffe7\BinProductVersion4.3.0.0NT AUTHORITY\SYSTEM 13241300x800000000000000010733Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.532{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unins000.exe|7f9839beea0077f1\LowerCaseLongPathc:\users\administrator\appdata\local\programs\ollama\unins000.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010734Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.532{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unins000.exe|7f9839beea0077f1\Publisherollama NT AUTHORITY\SYSTEM 13241300x800000000000000010735Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.532{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unins000.exe|7f9839beea0077f1\LinkDate01/08/2025 15:36:35NT AUTHORITY\SYSTEM 13241300x800000000000000010736Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.532{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unins000.exe|7f9839beea0077f1\BinProductVersion0.11.11.0NT AUTHORITY\SYSTEM 13241300x800000000000000010737Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.534{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unins000.exe|7f9839beea0077f1\LowerCaseLongPathc:\users\administrator\appdata\local\programs\ollama\unins000.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010738Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.534{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unins000.exe|7f9839beea0077f1\Publisherollama NT AUTHORITY\SYSTEM 13241300x800000000000000010739Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.534{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unins000.exe|7f9839beea0077f1\LinkDate01/08/2025 15:36:35NT AUTHORITY\SYSTEM 13241300x800000000000000010740Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.534{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\unins000.exe|7f9839beea0077f1\BinProductVersion0.11.11.0NT AUTHORITY\SYSTEM 13241300x800000000000000010741Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.538{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\upfc.exe|5e5b940356e40b74\LowerCaseLongPathc:\windows\system32\upfc.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010742Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.538{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\upfc.exe|5e5b940356e40b74\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010743Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.538{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\upfc.exe|5e5b940356e40b74\LinkDate06/19/1977 11:46:01NT AUTHORITY\SYSTEM 13241300x800000000000000010744Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.538{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\upfc.exe|5e5b940356e40b74\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010745Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.538{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\userinit.exe|b21bd46ff8053d3c\LowerCaseLongPathc:\windows\system32\userinit.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010746Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.538{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\userinit.exe|b21bd46ff8053d3c\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010747Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.538{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\userinit.exe|b21bd46ff8053d3c\LinkDate03/16/1977 14:44:39NT AUTHORITY\SYSTEM 13241300x800000000000000010748Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.538{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\userinit.exe|b21bd46ff8053d3c\BinProductVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010749Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.540{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\usoclient.exe|fe093c71b7abec54\LowerCaseLongPathc:\windows\system32\usoclient.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010750Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.540{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\usoclient.exe|fe093c71b7abec54\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010751Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.540{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\usoclient.exe|fe093c71b7abec54\LinkDate12/25/1972 02:06:28NT AUTHORITY\SYSTEM 13241300x800000000000000010752Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.540{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\usoclient.exe|fe093c71b7abec54\BinProductVersion10.0.26100.3037NT AUTHORITY\SYSTEM 13241300x800000000000000010753Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.544{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vgauthservice.ex|2eefeb8d422b68c0\LowerCaseLongPathc:\program files\vmware\vmware tools\vmware vgauth\vgauthservice.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010754Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.544{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vgauthservice.ex|2eefeb8d422b68c0\Publishervmware, inc.NT AUTHORITY\SYSTEM 13241300x800000000000000010755Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.544{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vgauthservice.ex|2eefeb8d422b68c0\LinkDate05/02/2024 06:15:43NT AUTHORITY\SYSTEM 13241300x800000000000000010756Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.544{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vgauthservice.ex|2eefeb8d422b68c0\BinProductVersion17.0.0.5473NT AUTHORITY\SYSTEM 13241300x800000000000000010757Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.548{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vm3dservice.exe|6ff0ee25bab6bb16\LowerCaseLongPathc:\windows\system32\vm3dservice.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010758Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.548{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vm3dservice.exe|6ff0ee25bab6bb16\Publishervmware, inc.NT AUTHORITY\SYSTEM 13241300x800000000000000010759Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.548{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vm3dservice.exe|6ff0ee25bab6bb16\LinkDate04/19/2024 20:54:04NT AUTHORITY\SYSTEM 13241300x800000000000000010760Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.548{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vm3dservice.exe|6ff0ee25bab6bb16\BinProductVersion9.17.7.4NT AUTHORITY\SYSTEM 13241300x800000000000000010761Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.550{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vmtoolsd.exe|ab980160c33e8fa1\LowerCaseLongPathc:\program files\vmware\vmware tools\vmtoolsd.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010762Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.550{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vmtoolsd.exe|ab980160c33e8fa1\Publishervmware, inc.NT AUTHORITY\SYSTEM 13241300x800000000000000010763Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.550{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vmtoolsd.exe|ab980160c33e8fa1\LinkDate05/02/2024 09:14:36NT AUTHORITY\SYSTEM 13241300x800000000000000010764Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.550{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\vmtoolsd.exe|ab980160c33e8fa1\BinProductVersion12.4.5.49651NT AUTHORITY\SYSTEM 13241300x800000000000000010765Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.554{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\waasmedicagent.e|387adc0eeaef539a\LowerCaseLongPathc:\windows\uus\amd64\waasmedicagent.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010766Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.554{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\waasmedicagent.e|387adc0eeaef539a\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010767Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.554{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\waasmedicagent.e|387adc0eeaef539a\LinkDate07/20/2002 10:39:38NT AUTHORITY\SYSTEM 13241300x800000000000000010768Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.554{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\waasmedicagent.e|387adc0eeaef539a\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010769Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.559{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wazuh-agent.exe|52f6b73a63fc6e\LowerCaseLongPathc:\program files (x86)\ossec-agent\wazuh-agent.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010770Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.559{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wazuh-agent.exe|52f6b73a63fc6e\Publisherwazuh inc.NT AUTHORITY\SYSTEM 13241300x800000000000000010771Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.559{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wazuh-agent.exe|52f6b73a63fc6e\LinkDate10/24/2023 08:18:32NT AUTHORITY\SYSTEM 13241300x800000000000000010772Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.559{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wazuh-agent.exe|52f6b73a63fc6e\BinProductVersion4.6.0.0NT AUTHORITY\SYSTEM 13241300x800000000000000010773Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.567{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\werfault.exe|6ef8f048a55d3a7f\LowerCaseLongPathc:\windows\system32\werfault.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010774Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.567{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\werfault.exe|6ef8f048a55d3a7f\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010775Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.567{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\werfault.exe|6ef8f048a55d3a7f\LinkDate01/12/2078 04:03:50NT AUTHORITY\SYSTEM 13241300x800000000000000010776Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.567{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\werfault.exe|6ef8f048a55d3a7f\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010777Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.571{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\werfaultsecure.e|d654a6ffa1b3f1c7\LowerCaseLongPathc:\windows\system32\werfaultsecure.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010778Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.571{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\werfaultsecure.e|d654a6ffa1b3f1c7\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010779Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.571{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\werfaultsecure.e|d654a6ffa1b3f1c7\LinkDate12/14/2030 00:49:12NT AUTHORITY\SYSTEM 13241300x800000000000000010780Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.571{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\werfaultsecure.e|d654a6ffa1b3f1c7\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010781Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.577{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wermgr.exe|ab945ca7a8b4f808\LowerCaseLongPathc:\windows\syswow64\wermgr.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010782Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.577{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wermgr.exe|ab945ca7a8b4f808\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010783Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.577{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wermgr.exe|ab945ca7a8b4f808\LinkDate06/22/2058 22:24:44NT AUTHORITY\SYSTEM 13241300x800000000000000010784Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.577{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wermgr.exe|ab945ca7a8b4f808\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010785Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.579{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wermgr.exe|ae5df027a4ca83dd\LowerCaseLongPathc:\windows\system32\wermgr.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010786Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.579{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wermgr.exe|ae5df027a4ca83dd\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010787Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.579{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wermgr.exe|ae5df027a4ca83dd\LinkDate02/24/2048 14:54:29NT AUTHORITY\SYSTEM 13241300x800000000000000010788Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.579{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wermgr.exe|ae5df027a4ca83dd\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010789Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.579{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wevtutil.exe|f1c7ea938fdf696d\LowerCaseLongPathc:\windows\system32\wevtutil.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010790Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.579{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wevtutil.exe|f1c7ea938fdf696d\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010791Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.579{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wevtutil.exe|f1c7ea938fdf696d\LinkDate02/15/2079 19:38:51NT AUTHORITY\SYSTEM 13241300x800000000000000010792Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.579{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wevtutil.exe|f1c7ea938fdf696d\BinProductVersion10.0.26100.1150NT AUTHORITY\SYSTEM 13241300x800000000000000010793Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.597{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wftpserver.exe|f15cdefa93d50d2c\LowerCaseLongPathc:\program files (x86)\wing ftp server\wftpserver.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010794Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.597{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wftpserver.exe|f15cdefa93d50d2c\LinkDate07/02/2014 06:15:17NT AUTHORITY\SYSTEM 13241300x800000000000000010795Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.603{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\widgets.exe|a9c930271e359c22\LowerCaseLongPathc:\program files\windowsapps\microsoftwindows.client.webexperience_525.22301.90.0_x64__cw5n1h2txyewy\dashboard\widgets.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010796Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.603{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\widgets.exe|a9c930271e359c22\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010797Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.603{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\widgets.exe|a9c930271e359c22\LinkDate08/19/2025 07:17:37NT AUTHORITY\SYSTEM 13241300x800000000000000010798Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.603{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\widgets.exe|a9c930271e359c22\BinProductVersion525.22301.40.0NT AUTHORITY\SYSTEM 13241300x800000000000000010799Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.603{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\widgetservice.ex|ae8ecd4a4cacc470\LowerCaseLongPathc:\program files\windowsapps\microsoft.widgetsplatformruntime_1.6.14.0_x64__8wekyb3d8bbwe\widgetservice\widgetservice.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010800Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.603{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\widgetservice.ex|ae8ecd4a4cacc470\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010801Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.603{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\widgetservice.ex|ae8ecd4a4cacc470\LinkDate07/07/2015 14:50:16NT AUTHORITY\SYSTEM 13241300x800000000000000010802Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.603{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\widgetservice.ex|ae8ecd4a4cacc470\BinProductVersion0.5.0.0NT AUTHORITY\SYSTEM 13241300x800000000000000010803Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.611{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windeploy.exe|3d482a077f170021\LowerCaseLongPathc:\windows\system32\oobe\windeploy.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010804Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.611{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windeploy.exe|3d482a077f170021\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010805Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.611{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windeploy.exe|3d482a077f170021\LinkDate02/02/2103 17:50:02NT AUTHORITY\SYSTEM 13241300x800000000000000010806Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.611{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windeploy.exe|3d482a077f170021\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010807Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.611{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windowspackagema|2a2dd2139de4fd0\LowerCaseLongPathc:\program files\windowsapps\microsoft.desktopappinstaller_1.26.430.0_x64__8wekyb3d8bbwe\windowspackagemanagerserver.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010808Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.611{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windowspackagema|2a2dd2139de4fd0\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010809Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.611{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windowspackagema|2a2dd2139de4fd0\LinkDate07/17/2025 18:02:33NT AUTHORITY\SYSTEM 13241300x800000000000000010810Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.611{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windowspackagema|2a2dd2139de4fd0\BinProductVersion1.26.430.0NT AUTHORITY\SYSTEM 13241300x800000000000000010811Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.613{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windowsterminal.|b11a4a4325aa94a7\LowerCaseLongPathc:\program files\windowsapps\microsoft.windowsterminal_1.22.12111.0_x64__8wekyb3d8bbwe\windowsterminal.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010812Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.613{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windowsterminal.|b11a4a4325aa94a7\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010813Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.613{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windowsterminal.|b11a4a4325aa94a7\LinkDate07/30/2025 17:24:27NT AUTHORITY\SYSTEM 13241300x800000000000000010814Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.613{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\windowsterminal.|b11a4a4325aa94a7\BinProductVersion1.22.2507.30001NT AUTHORITY\SYSTEM 13241300x800000000000000010815Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.615{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wininit.exe|92052297798522\LowerCaseLongPathc:\windows\system32\wininit.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010816Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.615{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wininit.exe|92052297798522\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010817Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.615{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wininit.exe|92052297798522\LinkDate02/15/2097 03:33:59NT AUTHORITY\SYSTEM 13241300x800000000000000010818Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.615{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wininit.exe|92052297798522\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010819Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.619{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\winlogon.exe|7111cb227d6798fb\LowerCaseLongPathc:\windows\system32\winlogon.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010820Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.619{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\winlogon.exe|7111cb227d6798fb\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010821Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.619{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\winlogon.exe|7111cb227d6798fb\LinkDate07/17/2027 20:23:25NT AUTHORITY\SYSTEM 13241300x800000000000000010822Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.619{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\winlogon.exe|7111cb227d6798fb\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010823Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.643{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\winsat.exe|bdbc7af94f920c2d\LowerCaseLongPathc:\windows\system32\winsat.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010824Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.643{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\winsat.exe|bdbc7af94f920c2d\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010825Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.643{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\winsat.exe|bdbc7af94f920c2d\LinkDate01/07/2026 09:07:48NT AUTHORITY\SYSTEM 13241300x800000000000000010826Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.643{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\winsat.exe|bdbc7af94f920c2d\BinProductVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010827Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.651{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wmiprvse.exe|124e12238fc8c4e4\LowerCaseLongPathc:\windows\system32\wbem\wmiprvse.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010828Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.651{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wmiprvse.exe|124e12238fc8c4e4\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010829Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.651{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wmiprvse.exe|124e12238fc8c4e4\LinkDate06/09/2003 18:54:17NT AUTHORITY\SYSTEM 13241300x800000000000000010830Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.651{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wmiprvse.exe|124e12238fc8c4e4\BinProductVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000010831Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.655{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wsl.exe|88d5e8ee009f35b9\LowerCaseLongPathc:\windows\system32\wsl.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010832Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.655{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wsl.exe|88d5e8ee009f35b9\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010833Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.655{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wsl.exe|88d5e8ee009f35b9\LinkDate01/12/2009 20:27:19NT AUTHORITY\SYSTEM 13241300x800000000000000010834Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.655{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wsl.exe|88d5e8ee009f35b9\BinProductVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010835Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.667{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wslservice.exe|72bc8a5fea501aa3\LowerCaseLongPathc:\program files\wsl\wslservice.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010836Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.667{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wslservice.exe|72bc8a5fea501aa3\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010837Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.667{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wslservice.exe|72bc8a5fea501aa3\LinkDate11/09/2024 16:24:56NT AUTHORITY\SYSTEM 13241300x800000000000000010838Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.667{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wslservice.exe|72bc8a5fea501aa3\BinProductVersion5.0.1.1NT AUTHORITY\SYSTEM 13241300x800000000000000010839Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.671{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wuaucltcore.exe|49c19336683ae935\LowerCaseLongPathc:\windows\uus\amd64\wuaucltcore.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010840Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.671{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wuaucltcore.exe|49c19336683ae935\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010841Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.671{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wuaucltcore.exe|49c19336683ae935\LinkDate06/17/2101 11:07:35NT AUTHORITY\SYSTEM 13241300x800000000000000010842Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.671{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wuaucltcore.exe|49c19336683ae935\BinProductVersion1310.2506.11012.0NT AUTHORITY\SYSTEM 13241300x800000000000000010843Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:23:41.677{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wudfhost.exe|591959b03299c0d\LowerCaseLongPathc:\windows\system32\wudfhost.exeNT AUTHORITY\SYSTEM 13241300x800000000000000010844Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:23:41.677{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wudfhost.exe|591959b03299c0d\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000010845Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:23:41.677{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wudfhost.exe|591959b03299c0d\LinkDate02/26/2047 03:50:14NT AUTHORITY\SYSTEM 13241300x800000000000000010846Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:23:41.677{8223a6b9-154f-6902-f801-000000002b00}5072C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\wudfhost.exe|591959b03299c0d\BinProductVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010847Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:41.931{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\scsi/disk&ven_nvme&prod_vmware_virtual_n/5&25a13950&0&000000\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010848Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:41.931{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07f0&subsys_07f015ad&rev_00/4&3b50545d&0&00b8\DriverVerVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010849Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:41.977{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\acpi/acpi0003/1\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010850Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.058{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_8086&dev_7191&subsys_00000000&rev_01/3&61aaa01&0&08\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010851Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.064{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\root/volmgr/0000\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010852Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.064{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\acpi/pnp0a03/2&daba3ff&0\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010853Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.068{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\root/basicdisplay/0000\DriverVerVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010854Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.072{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\acpi/vmw0004/0\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010855Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.924{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\root/vid/0000\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010856Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.940{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\root/spaceport/0000\DriverVerVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010857Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.951{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\root/kdnic/0000\DriverVerVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010858Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.951{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&a8\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010859Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.953{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&a9\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010860Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.953{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&aa\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010861Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.953{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&ab\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010862Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.955{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&ac\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010863Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.955{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&ad\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010864Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.956{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&ae\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010865Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.956{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&af\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010866Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.956{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&b0\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010867Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.958{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&b1\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010868Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.958{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&b2\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010869Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.958{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&b3\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010870Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.958{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&b4\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010871Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.960{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&b5\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010872Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.960{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&b6\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010873Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.960{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&b7\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010874Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:42.960{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&b8\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010875Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.936{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&b9\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010876Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.941{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&ba\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010877Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.941{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&bb\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010878Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.943{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&bc\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010879Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.943{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&bd\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010880Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.943{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&be\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010881Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.945{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&bf\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010882Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.945{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&c0\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010883Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.945{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&c1\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010884Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.947{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&c2\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010885Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.947{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&c3\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010886Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.947{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&c4\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010887Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.949{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&c5\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010888Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.949{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&c6\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010889Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.949{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07a0&subsys_07a015ad&rev_01/3&61aaa01&0&c7\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010890Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.952{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\hdaudio/func_01&ven_15ad&dev_1975&subsys_15ad1975&rev_1001/5&217be3d6&0&0001\DriverVerVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010891Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.952{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_0774&subsys_197615ad&rev_00/4&bbf9765&0&0088\DriverVerVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000010892Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.952{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\root/vpcivsp/0000\DriverVerVersion10.0.26100.3037NT AUTHORITY\SYSTEM 13241300x800000000000000010893Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:43.958{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_0770&subsys_077015ad&rev_00/4&bbf9765&0&1088\DriverVerVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000010894Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.942{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_1977&subsys_197715ad&rev_09/4&bbf9765&0&0888\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010895Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.956{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\acpi_hal/pnp0c08/0\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010896Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.956{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\root/basicrender/0000\DriverVerVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010897Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.961{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\acpi_hal/uefi/0\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010898Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.963{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\acpi/genuineintel_-_intel64_family_6_model_154_-_12th_gen_intel(r)_core(tm)_i5-1240p/_0\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010899Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.963{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\acpi/genuineintel_-_intel64_family_6_model_154_-_12th_gen_intel(r)_core(tm)_i5-1240p/_1\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010900Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.963{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\acpi/genuineintel_-_intel64_family_6_model_154_-_12th_gen_intel(r)_core(tm)_i5-1240p/_2\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010901Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.963{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\acpi/genuineintel_-_intel64_family_6_model_154_-_12th_gen_intel(r)_core(tm)_i5-1240p/_3\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010902Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.963{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_8086&dev_7111&subsys_197615ad&rev_01/3&61aaa01&0&39\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010903Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.972{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\root/storvsp/0000\DriverVerVersion10.0.26100.4652NT AUTHORITY\SYSTEM 13241300x800000000000000010904Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.972{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pciide/idechannel/4&23686003&0&0\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010905Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.972{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pciide/idechannel/4&23686003&0&1\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010906Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.976{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\usb/root_hub20/5&36a4b5d6&0\DriverVerVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000010907Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.978{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\usb/root_hub/5&2891968b&0\DriverVerVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000010908Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.985{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_07e0&subsys_07e015ad&rev_00/4&bbf9765&0&1888\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010909Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.985{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_0790&subsys_079015ad&rev_02/3&61aaa01&0&88\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010910Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.987{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\root/system/0000\DriverVerVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010911Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.989{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\swd/mmdevapi/{0.0.1.00000000}.{9a7526dc-b447-4185-b852-6d454330c217}\DriverVerVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000010912Microsoft-Windows-Sysmon/Operationalsoc101win11Context,DeviceConnectedOrUpdatedSetValue2025-10-29 13:23:44.989{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDeviceContainer\{c475a361-a2e6-6c4e-4dda-c3731b4beeb3}\FriendlyNameMicrophone (High Definition Audio Device)NT AUTHORITY\SYSTEM 13241300x800000000000000010913Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:44.994{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\display/default_monitor/4&427137e&0&uid0\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010914Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:45.946{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\pci/ven_15ad&dev_077a&subsys_077a15ad&rev_00/4&1ee266c4&0&00b0\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010915Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:45.950{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\usb/root_hub30/5&11106705&0&0\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010916Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:45.950{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\swd/mmdevapi/{0.0.0.00000000}.{f0c5979a-a346-411a-bd61-25c75f1b113f}\DriverVerVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000010917Microsoft-Windows-Sysmon/Operationalsoc101win11Context,DeviceConnectedOrUpdatedSetValue2025-10-29 13:23:45.950{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDeviceContainer\{cf788797-6b4a-1c54-5418-3cb035518e98}\FriendlyNameSpeakers (High Definition Audio Device)NT AUTHORITY\SYSTEM 13241300x800000000000000010918Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:45.960{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\usb/vid_0e0f&pid_0003&mi_01/7&bcbfcc2&0&0001\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010919Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:45.960{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\usb/vid_0e0f&pid_0003&mi_00/7&bcbfcc2&0&0000\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010920Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:45.960{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\usb/vid_0e0f&pid_0003/6&39d724fe&0&5\DriverVerVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010921Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.201{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/acpi.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010922Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.211{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/acpidev.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010923Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.227{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/acx01000.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010924Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.243{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/afd.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010925Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.243{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/afunix.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010926Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.243{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ahcache.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010927Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.267{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/amdk8.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010928Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.277{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/amdppm.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010929Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.283{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/appid.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010930Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.952{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/applockerfltr.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010931Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.981{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/atapi.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010932Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.983{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/bam.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010933Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.983{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/basicdisplay.inf_amd64_2753efdbb0d9a226/basicdisplay.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010934Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.999{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/basicrender.inf_amd64_4a022393fa7795f1/basicrender.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010935Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.999{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/bfs.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010936Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:46.999{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/bindflt.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010937Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.015{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/bowser.sys\DriverVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000010938Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.015{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/bthenum.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010939Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.040{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/microsoft.bluetooth.legacy.leenumerator.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010940Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.042{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/bthmini.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010941Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.047{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/bthmodem.sys\DriverVersion10.0.26100.4061NT AUTHORITY\SYSTEM 13241300x800000000000000010942Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.081{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/bthport.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010943Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.081{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/bthusb.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010944Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.100{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/buttonconverter.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010945Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.111{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/cad.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010946Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.111{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/cdd.dll\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010947Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.139{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/cldflt.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010948Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.150{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/clfs.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010949Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.154{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/cmbatt.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010950Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.175{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/cng.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010951Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.192{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/csc.sys\DriverVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000010952Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.192{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/dam.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010953Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.207{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/disk.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010954Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.209{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/dmvsc.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010955Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.223{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/drmkaud.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010956Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.271{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/dxgkrnl.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010957Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.287{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ehstorclass.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010958Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.287{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/executioncontext.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010959Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.302{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/filetrace.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010960Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.318{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/fltmgr.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010961Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.350{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/fvevol.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010962Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.350{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/genericusbfn.inf_amd64_71c810ddc0116541/genericusbfn.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010963Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.375{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/msgpioclx.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010964Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.381{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/hdaudio.sys\DriverVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010965Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.382{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/hdaudbus.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010966Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.382{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/hidi2c.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010967Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.400{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/hidspicx.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010968Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.400{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/hidusb.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010969Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.416{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/hnswfpdriver.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010970Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.416{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/hsp.sys\DriverVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010971Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.446{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/http.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010972Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.447{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/hvcrash.sys\DriverVersion10.0.26100.3912NT AUTHORITY\SYSTEM 13241300x800000000000000010973Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.461{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/hvservice.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010974Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.461{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/hwpolicy.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010975Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.477{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/i3chost.inf_amd64_d4247b39ddc61336/i3chost.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010976Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.493{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/indirectkmd.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010977Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.493{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/intelide.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010978Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.509{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/intelpep.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010979Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.509{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/intelpmt.sys\DriverVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010980Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.524{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/intelppm.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010981Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.524{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ipfltdrv.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010982Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.542{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ipmidrv.sys\DriverVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000010983Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.542{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ipnat.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010984Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.564{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/msiscsi.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010985Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.571{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/kdnic.sys\DriverVersion6.2.1.0NT AUTHORITY\SYSTEM 13241300x800000000000000010986Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.571{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ksecdd.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010987Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.587{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ksecpkg.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010988Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.603{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wd/ksld.sys\DriverVersion1.1.25081.3013NT AUTHORITY\SYSTEM 13241300x800000000000000010989Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.603{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ksthunk.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000010990Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.619{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/l1vhlwf.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010991Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.623{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/l2bridge.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010992Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.629{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/lltdio.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010993Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.635{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/luafv.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010994Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.653{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mausbhost.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010995Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.666{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mausbip.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000010996Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.680{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mbbcx.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010997Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.685{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/microsoft.bluetooth.avrcptransport.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000010998Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.685{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mmcss.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000010999Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.701{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/modem.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011000Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.701{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/monitor.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011001Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.714{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mrxsmb.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000011002Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.730{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mrxsmb10.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011003Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.730{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mrxsmb20.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011004Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.748{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/bridge.sys\DriverVersion10.0.26100.2454NT AUTHORITY\SYSTEM 13241300x800000000000000011005Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.754{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mskssrv.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011006Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.762{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mspclock.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011007Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.765{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mspqm.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011008Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.778{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/msquic.sys\DriverVersion2.4.11.0NT AUTHORITY\SYSTEM 13241300x800000000000000011009Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.778{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/msquicprev.sys\DriverVersion2.3.12.0NT AUTHORITY\SYSTEM 13241300x800000000000000011010Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.799{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/msseccore.sys\DriverVersion10.8798.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011011Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.812{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mssecflt.sys\DriverVersion10.8798.25857.1000NT AUTHORITY\SYSTEM 13241300x800000000000000011012Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.817{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mssecwfp.sys\DriverVersion10.8798.25857.1000NT AUTHORITY\SYSTEM 13241300x800000000000000011013Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.822{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mstee.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011014Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.825{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/mup.sys\DriverVersion10.0.26100.4061NT AUTHORITY\SYSTEM 13241300x800000000000000011015Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.853{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/nwifi.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011016Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.890{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ndis.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011017Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.897{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ndiscap.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000011018Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.907{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ndisimplatform.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011019Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.907{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ndistapi.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011020Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.921{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ndiswan.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011021Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.929{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ndproxy.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011022Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.936{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ndu.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011023Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.936{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/netadaptercx.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011024Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.954{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/netbt.sys\DriverVersion10.0.26100.4652NT AUTHORITY\SYSTEM 13241300x800000000000000011025Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.967{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/netvsc.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011026Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.967{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/networkprivacypolicy.inf_amd64_175be12a1ceba7e2/networkprivacypolicy.sys\DriverVersionMissingNT AUTHORITY\SYSTEM 13241300x800000000000000011027Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.967{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/nsiproxy.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011028Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.988{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/nvdimm.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011029Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.994{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/nvmedisk.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000011030Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:47.999{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/p9rdr.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011031Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.015{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/partmgr.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011032Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.015{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/pci.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011033Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.015{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/pciide.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011034Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.031{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/pdc.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011035Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.047{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/peauth.sys\DriverVersion10.0.26100.4652NT AUTHORITY\SYSTEM 13241300x800000000000000011036Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.069{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/pktmon.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011037Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.075{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/pktmonapi.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011038Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.081{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/pluton-heci.inf_amd64_2dd7270ad04edb22/pluton-heci.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011039Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.094{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/pmem.sys\DriverVersion10.0.26100.3912NT AUTHORITY\SYSTEM 13241300x800000000000000011040Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.099{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/processr.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011041Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.114{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/qwavedrv.sys\DriverVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000011042Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.128{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/agilevpn.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011043Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.135{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/rasl2tp.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011044Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.143{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/rdpdr.sys\DriverVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000011045Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.157{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/rdyboost.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011046Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.170{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/rfcomm.sys\DriverVersion10.0.26100.4061NT AUTHORITY\SYSTEM 13241300x800000000000000011047Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.178{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/routepolicy.sys\DriverVersion10.0.26100.3037NT AUTHORITY\SYSTEM 13241300x800000000000000011048Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.182{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/rspndr.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011049Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.191{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/scfilter.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000011050Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.206{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/scmbus.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000011051Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.221{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/sdbus.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011052Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.229{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/sdstor.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011053Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.247{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/smbdirect.sys\DriverVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000011054Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.255{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/spaceparser.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000011055Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.265{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/spaceport.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000011056Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.271{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/spbcx.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011057Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.280{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/srv.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011058Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.290{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/srv2.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011059Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.297{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/srvnet.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011060Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.302{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/storahci.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011061Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.307{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/stornvme.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000011062Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.313{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/storufs.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011063Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.320{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/storvsc.sys\DriverVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000011064Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.320{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/storvsp.sys\DriverVersion10.0.26100.4652NT AUTHORITY\SYSTEM 13241300x800000000000000011065Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.320{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/swenum.inf_amd64_8b9dd76f362e3ec6/swenum.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011066Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.373{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/tcpip.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011067Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.380{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/tcpipreg.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011068Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.391{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/tdx.sys\DriverVersion10.0.26100.4652NT AUTHORITY\SYSTEM 13241300x800000000000000011069Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.396{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/c_thermal.inf_amd64_29c3532559395caa/thermalfilter.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011070Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.396{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/tpm.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011071Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.412{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/tsusbflt.sys\DriverVersion10.0.26100.2894NT AUTHORITY\SYSTEM 13241300x800000000000000011072Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.412{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/tsusbgd.sys\DriverVersion10.0.26100.2894NT AUTHORITY\SYSTEM 13241300x800000000000000011073Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.430{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/tunnel.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011074Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.444{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ucmcx.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011075Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.452{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ucmucsicx.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011076Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.462{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ucpd.sys\DriverVersion4.3.0.0NT AUTHORITY\SYSTEM 13241300x800000000000000011077Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.470{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ucx01000.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011078Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.476{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/udecx.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000011079Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.484{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/udfs.sys\DriverVersion10.0.26100.4652NT AUTHORITY\SYSTEM 13241300x800000000000000011080Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.486{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/uefi.inf_amd64_76e7c15a1110d3a0/uefi.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011081Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.497{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/uiomap.inf_amd64_2f71bdab19510aef/uiomap.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011082Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.511{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/usb-platformdetection.inf_amd64_dd328ec315d48717/usb-platformdetection.sys\DriverVersionMissingNT AUTHORITY\SYSTEM 13241300x800000000000000011083Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.538{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/usb4devicerouter.inf_amd64_f4352c97d57d5d7f/usb4devicerouter.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011084Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.557{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/usb4hostrouter.inf_amd64_d8c2526d2b56c531/usb4hostrouter.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011085Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.570{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/usbaudio.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011086Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.571{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/usbccgp.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011087Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.571{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/usbehci.sys\DriverVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000011088Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.571{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/usbhub.sys\DriverVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000011089Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.587{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/usbhub3.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011090Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.587{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/usbohci.sys\DriverVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000011091Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.603{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/usbprint.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011092Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.603{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/usbser.sys\DriverVersion10.0.26100.2454NT AUTHORITY\SYSTEM 13241300x800000000000000011093Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.619{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/usbstor.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011094Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.619{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/usbuhci.sys\DriverVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000011095Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.635{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/usbxhci.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011096Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.635{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/verifierext.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011097Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.651{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vfpext.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011098Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.667{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vhdmp.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000011099Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.683{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vhdparser.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011100Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.699{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vhf.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011101Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.715{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vid.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011102Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.715{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vmbus.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011103Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.731{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vmbusproxy.sys\DriverVersion10.0.26100.4066NT AUTHORITY\SYSTEM 13241300x800000000000000011104Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.731{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vmbusr.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011105Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.747{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vmsproxyhnic.sys\DriverVersion10.0.26100.3912NT AUTHORITY\SYSTEM 13241300x800000000000000011106Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.763{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vmswitch.sys\DriverVersion10.0.26100.4946NT AUTHORITY\SYSTEM 13241300x800000000000000011107Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.778{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vmsproxy.sys\DriverVersion10.0.26100.3912NT AUTHORITY\SYSTEM 13241300x800000000000000011108Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.784{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/volmgr.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011109Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.794{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/volsnap.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011110Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.812{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vpci.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011111Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.814{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vpcivsp.sys\DriverVersion10.0.26100.3037NT AUTHORITY\SYSTEM 13241300x800000000000000011112Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.825{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/vwififlt.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000011113Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.833{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wanarp.sys\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011114Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.839{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wcifs.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011115Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.848{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wd/wdboot.sys\DriverVersion4.18.25080.5NT AUTHORITY\SYSTEM 13241300x800000000000000011116Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.857{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wdf01000.sys\DriverVersion1.35.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011117Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.873{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wd/wdfilter.sys\DriverVersion4.18.25080.5NT AUTHORITY\SYSTEM 13241300x800000000000000011118Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.889{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wdiwifi.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011119Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.905{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wdmcompanionfilter.sys\DriverVersion10.0.26100.2454NT AUTHORITY\SYSTEM 13241300x800000000000000011120Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.905{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wd/wdnisdrv.sys\DriverVersion4.18.25080.5NT AUTHORITY\SYSTEM 13241300x800000000000000011121Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.921{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wfplwfs.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011122Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.937{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wificx.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011123Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.937{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wimmount.sys\DriverVersion10.0.26100.3624NT AUTHORITY\SYSTEM 13241300x800000000000000011124Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.953{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/windowstrustedrt.sys\DriverVersion10.0.26100.4061NT AUTHORITY\SYSTEM 13241300x800000000000000011125Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.953{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/windowstrustedrtproxy.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000011126Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.953{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/wini3ctarget.inf_amd64_a0f0ccbe333937ce/wini3ctarget.sys\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000011127Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.969{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/winnat.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011128Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.969{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ws2ifsl.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011129Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.985{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wtd.sys\DriverVersion10.0.26100.4061NT AUTHORITY\SYSTEM 13241300x800000000000000011130Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:48.996{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wudfpf.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011131Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.006{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/wudfrd.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011132Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.017{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/xboxgip.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011133Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.017{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/xinputhid.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011134Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.034{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/ztdns.sys\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011135Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.034{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/hidcfu.inf_amd64_1fb64427d6480a8b/hidcfu.dll\DriverVersion1.0.0.0NT AUTHORITY\SYSTEM 13241300x800000000000000011136Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.052{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/hidi3c.inf_amd64_713eab098670616d/hidi3c.dll\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011137Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.065{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/umdf/microsoft.bluetooth.profiles.hidovergatt.dll\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011138Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.065{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/umdf/hidtelephony.dll\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000011139Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.081{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/umdf/iddcx.dll\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011140Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.096{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/umdf/netadaptercxum.dll\DriverVersion10.0.26100.4202NT AUTHORITY\SYSTEM 13241300x800000000000000011141Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.112{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/umdf/nfccx.dll\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011142Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.128{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/rdpidd.inf_amd64_449e893f6a845b9b/rdpidd.dll\DriverVersion10.0.26100.4484NT AUTHORITY\SYSTEM 13241300x800000000000000011143Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.130{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/umdf/sensorscx.dll\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 13241300x800000000000000011144Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.144{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/umdf/smccx.dll\DriverVersion10.0.26100.3323NT AUTHORITY\SYSTEM 13241300x800000000000000011145Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.144{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/driverstore/filerepository/storfwupdate.inf_amd64_fa7e1db8cfcc4f82/storfwupdate.dll\DriverVersion1.0.0.0NT AUTHORITY\SYSTEM 13241300x800000000000000011146Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.162{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/umdf/ucmcx.dll\DriverVersion10.0.26100.3912NT AUTHORITY\SYSTEM 13241300x800000000000000011147Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:23:49.162{8223a6b9-155d-6902-fa01-000000002b00}5664C:\WINDOWS\system32\compattelrunner.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDriverBinary\c:/windows/system32/drivers/umdf/usbxhcicompanion.dll\DriverVersion10.0.26100.4768NT AUTHORITY\SYSTEM 154100x800000000000000011148Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:53.051{8223a6b9-1569-6902-fe01-000000002b00}11296C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k smphostC:\WINDOWS\system32\NT AUTHORITY\NETWORK SERVICE{8223a6b9-1315-6902-e403-000000000000}0x3e40SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 22542200x800000000000000011149Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:53.443{8223a6b9-1319-6902-6700-000000002b00}5168SOC101WIN110fe80::a832:a53b:32c1:6645;::ffff:172.16.143.133;C:\Windows\System32\wbem\WmiPrvSE.exeNT AUTHORITY\NETWORK SERVICE 154100x800000000000000011150Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:57.844{8223a6b9-156d-6902-0002-000000002b00}1888C:\Windows\ImmersiveControlPanel\SystemSettings.exe10.0.26100.4652 (WinBuild.160101.0800)SettingsMicrosoft® Windows® Operating SystemMicrosoft CorporationSystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanelC:\Windows\ImmersiveControlPanel\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=B237E61BD46B8B0C37895661C182DDBC,SHA256=50DB6A50FC541E24F31FDCB240C97C9D3C267AFC4DE907BF1DCF9238EF2A914B,IMPHASH=1053E0B8206A1D7F7ECA60D282397B13{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x800000000000000011151Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:57.846{8223a6b9-156d-6902-0102-000000002b00}3700C:\Windows\System32\ApplicationFrameHost.exe10.0.26100.3912 (WinBuild.160101.0800)Application Frame HostMicrosoft® Windows® Operating SystemMicrosoft CorporationApplicationFrameHost.exeC:\WINDOWS\system32\ApplicationFrameHost.exe -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=697A42DE43B5E355657494C345FEE5E5,SHA256=83A5467E68D23292B55BF0D1E2CB22113776AE7B009C733F5010D7D1F7190CA7,IMPHASH=28580ECEB0562A8A7FBD08DC4F37B368{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x800000000000000011152Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:58.701{8223a6b9-156e-6902-0202-000000002b00}8428C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k LocalService -p -s SstpSvcC:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x800000000000000011153Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:23:58.801{8223a6b9-156e-6902-0302-000000002b00}5268C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe1450.2506.28022.0MoUSO Core Worker ProcessMicrosoft® Windows® Operating SystemMicrosoft CorporationMoUSOCoreWorker.exe"C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespacesC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=E048EE9A14933FFA4A9C9FC7A8A7F83B,SHA256=B4A080E7ABAC28ADCBB172B53060508457C9CEC25BC339F3DFA0A031CD881737,IMPHASH=D3DBFEDBF38C961BD70D128454E64766{8223a6b9-1393-6902-3901-000000002b00}10328C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UsoSvcNT AUTHORITY\SYSTEM 13241300x800000000000000011154Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:24:07.086{8223a6b9-1330-6902-cb00-000000002b00}10148C:\Windows\System32\smartscreen.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm-studio-0.3.30|11238f399652b123\LowerCaseLongPathc:\users\administrator\downloads\lm-studio-0.3.30-2-x64.exesoc101win11\Administrator 13241300x800000000000000011155Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:24:07.086{8223a6b9-1330-6902-cb00-000000002b00}10148C:\Windows\System32\smartscreen.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm-studio-0.3.30|11238f399652b123\Publisherlm studiosoc101win11\Administrator 13241300x800000000000000011156Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:24:07.086{8223a6b9-1330-6902-cb00-000000002b00}10148C:\Windows\System32\smartscreen.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm-studio-0.3.30|11238f399652b123\LinkDate12/15/2018 22:26:14soc101win11\Administrator 13241300x800000000000000011157Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:24:07.086{8223a6b9-1330-6902-cb00-000000002b00}10148C:\Windows\System32\smartscreen.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm-studio-0.3.30|11238f399652b123\BinProductVersion0.3.30.0soc101win11\Administrator 154100x800000000000000011158Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:09.184{8223a6b9-1579-6902-0902-000000002b00}10120C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivilegesC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4B730D779E8FFFAAD3320C097BE2B067,SHA256=A4291C5B4325895D13D32E232BF50C1B41356306803AC5DC75BBA9AECB021141,IMPHASH=E0220E5B585FC612AF76A6608C817F84{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011159Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:09.192{8223a6b9-1579-6902-0a02-000000002b00}7268C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" Scan -ScheduleJob -RestrictPrivileges -ScanType 1 -ScanTrigger 59C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4B730D779E8FFFAAD3320C097BE2B067,SHA256=A4291C5B4325895D13D32E232BF50C1B41356306803AC5DC75BBA9AECB021141,IMPHASH=E0220E5B585FC612AF76A6608C817F84{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011160Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:09.256{8223a6b9-1579-6902-0d02-000000002b00}1236C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" Scan -ScheduleJob -RestrictPrivileges -ScanType 1 -ScanTrigger 59 -ReinvokeC:\WINDOWS\system32\NT AUTHORITY\NETWORK SERVICE{8223a6b9-1315-6902-e403-000000000000}0x3e40SystemMD5=4B730D779E8FFFAAD3320C097BE2B067,SHA256=A4291C5B4325895D13D32E232BF50C1B41356306803AC5DC75BBA9AECB021141,IMPHASH=E0220E5B585FC612AF76A6608C817F84{8223a6b9-1579-6902-0a02-000000002b00}7268C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" Scan -ScheduleJob -RestrictPrivileges -ScanType 1 -ScanTrigger 59NT AUTHORITY\SYSTEM 154100x800000000000000011161Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:09.289{8223a6b9-1579-6902-0e02-000000002b00}10688C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdateC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4B730D779E8FFFAAD3320C097BE2B067,SHA256=A4291C5B4325895D13D32E232BF50C1B41356306803AC5DC75BBA9AECB021141,IMPHASH=E0220E5B585FC612AF76A6608C817F84{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x800000000000000011162Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:24:09.943{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\swd/msrras/{5e259276-bc7e-40e3-b93b-8f89b5f3abc0}\DriverVerVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000011163Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:24:09.952{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\swd/msrras/ms_sstpminiport\DriverVerVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000011164Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:24:09.956{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\swd/msrras/ms_agilevpnminiport\DriverVerVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000011165Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:24:09.963{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\swd/msrras/ms_l2tpminiport\DriverVerVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000011166Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:24:09.971{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\swd/msrras/ms_pptpminiport\DriverVerVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000011167Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:24:09.975{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\swd/msrras/ms_pppoeminiport\DriverVerVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000011168Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:24:09.981{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\swd/msrras/ms_ndiswanip\DriverVerVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000011169Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:24:09.985{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\swd/msrras/ms_ndiswanipv6\DriverVerVersion10.0.26100.1NT AUTHORITY\SYSTEM 13241300x800000000000000011170Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-DriverVerSetValue2025-10-29 13:24:09.990{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryDevicePnp\swd/msrras/ms_ndiswanbh\DriverVerVersion10.0.26100.1NT AUTHORITY\SYSTEM 154100x800000000000000011171Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:12.108{8223a6b9-157c-6902-1102-000000002b00}2576C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x800000000000000011172Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:12.139{8223a6b9-157c-6902-1202-000000002b00}5656C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x800000000000000011173Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:11.622{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exe0.3.30Discover, download, and run LLMs locallyLM StudioLM Studio-"C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exe" C:\Users\Administrator\Downloads\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=3F3FB643A297CEAD99CE29679B368C51,SHA256=0E59B73EF9A2D702AA349D85B483C5FF493BE320EC4844DA581EA3627D44183E,IMPHASH=B34F154EC913D2D2C435CBD644E91687{8223a6b9-1433-6902-8c01-000000002b00}6584C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" soc101win11\Administrator 13241300x800000000000000011174Microsoft-Windows-Sysmon/Operationalsoc101win11InvDBSetValue2025-10-29 13:24:13.072{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeBinary DataNT AUTHORITY\SYSTEM 11241100x800000000000000011175Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:14.717{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\System.dll2025-10-29 13:24:14.717soc101win11\Administrator 11241100x800000000000000011176Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:14.772{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\UAC.dll2025-10-29 13:24:14.772soc101win11\Administrator 11241100x800000000000000011177Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:14.842{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\StdUtils.dll2025-10-29 13:24:14.842soc101win11\Administrator 254200x800000000000000011178Microsoft-Windows-Sysmon/Operationalsoc101win11T10992025-10-29 13:24:14.903{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\modern-wizard.bmp2025-10-18 16:55:22.0002025-10-29 13:24:14.892soc101win11\Administrator 11241100x800000000000000011179Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:14.920{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\nsDialogs.dll2025-10-29 13:24:14.919soc101win11\Administrator 154100x800000000000000011180Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:18.733{8223a6b9-1582-6902-1302-000000002b00}3028C:\Windows\UUS\Packages\Preview\amd64\wuaucltcore.exe1407.2506.11012.0Windows UpdateMicrosoft® Windows® Operating SystemMicrosoft Corporationwuaucltcore.exe"C:\WINDOWS\uus\packages\preview\AMD64\wuaucltcore.exe" /DeploymentHandlerFullPath \\?\C:\Windows\UUS\Packages\Preview\AMD64\UpdateDeploy.dll /ClassId dce658da-05c0-4fda-92f6-26b4e5d2b45f /RunHandlerComServerC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=EA98A3ECEF7902605B361FC16D3D8081,SHA256=9C685412986F3939E7A84E62B09E319F4FA5B5C2B7006DE3441F6D4BB0CAC02D,IMPHASH=5FB5459A8931EA77DFAA79FC37CD9756{8223a6b9-1317-6902-3f00-000000002b00}3008C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauservNT AUTHORITY\SYSTEM 11241100x800000000000000011181Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:18.802{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exe2025-10-29 13:24:18.802NT AUTHORITY\SYSTEM 154100x800000000000000011182Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:18.968{8223a6b9-1582-6902-1402-000000002b00}8240C:\Windows\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exe4.18.25090.3009AntiMalware Platform Update (amd64fre)Microsoft Malware ProtectionMicrosoft CorporationUpdatePlatform.exe"C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exe" C:\WINDOWS\SoftwareDistribution\Download\Install\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF770F0BADC21AE6A474B8620DB5B2D7,SHA256=16EE7DE0A15360FD98DB1AB982792CE23EFB698B8EBA6347D6BD207AB30657DB,IMPHASH=1B8228588B13615766448489C5655246{8223a6b9-1582-6902-1302-000000002b00}3028C:\Windows\UUS\Packages\Preview\amd64\wuaucltcore.exe"C:\WINDOWS\uus\packages\preview\AMD64\wuaucltcore.exe" /DeploymentHandlerFullPath \\?\C:\Windows\UUS\Packages\Preview\AMD64\UpdateDeploy.dll /ClassId dce658da-05c0-4fda-92f6-26b4e5d2b45f /RunHandlerComServerNT AUTHORITY\SYSTEM 11241100x800000000000000011183Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.211{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\DefenderCSP.dll2025-10-29 13:24:19.211NT AUTHORITY\SYSTEM 11241100x800000000000000011184Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.233{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MdeDiag.dll2025-10-29 13:24:19.231NT AUTHORITY\SYSTEM 11241100x800000000000000011185Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.255{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MipDlp.dll2025-10-29 13:24:19.255NT AUTHORITY\SYSTEM 11241100x800000000000000011186Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.350{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpAsDesc.dll2025-10-29 13:24:19.350NT AUTHORITY\SYSTEM 11241100x800000000000000011187Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.357{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpAzSubmit.dll2025-10-29 13:24:19.357NT AUTHORITY\SYSTEM 11241100x800000000000000011188Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.381{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpClient.dll2025-10-29 13:24:19.381NT AUTHORITY\SYSTEM 11241100x800000000000000011189Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.403{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpCommu.dll2025-10-29 13:24:19.403NT AUTHORITY\SYSTEM 11241100x800000000000000011190Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.415{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpDetours.dll2025-10-29 13:24:19.415NT AUTHORITY\SYSTEM 11241100x800000000000000011191Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.425{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpDetoursCopyAccelerator.dll2025-10-29 13:24:19.425NT AUTHORITY\SYSTEM 11241100x800000000000000011192Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.433{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpDlp.dll2025-10-29 13:24:19.433NT AUTHORITY\SYSTEM 11241100x800000000000000011193Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.453{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpEvMsg.dll2025-10-29 13:24:19.453NT AUTHORITY\SYSTEM 11241100x800000000000000011194Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.473{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpOAV.dll2025-10-29 13:24:19.473NT AUTHORITY\SYSTEM 11241100x800000000000000011195Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.486{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpRtp.dll2025-10-29 13:24:19.484NT AUTHORITY\SYSTEM 11241100x800000000000000011196Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.502{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpSenseComm.dll2025-10-29 13:24:19.502NT AUTHORITY\SYSTEM 11241100x800000000000000011197Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.516{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpSvc.dll2025-10-29 13:24:19.516NT AUTHORITY\SYSTEM 11241100x800000000000000011198Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.587{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpUpdate.dll2025-10-29 13:24:19.587NT AUTHORITY\SYSTEM 11241100x800000000000000011199Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.595{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpUxAgent.dll2025-10-29 13:24:19.595NT AUTHORITY\SYSTEM 11241100x800000000000000011200Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.607{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MsMpLics.dll2025-10-29 13:24:19.607NT AUTHORITY\SYSTEM 11241100x800000000000000011201Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.613{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\NpRep.dll2025-10-29 13:24:19.613NT AUTHORITY\SYSTEM 11241100x800000000000000011202Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.637{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\ProtectionManagement.dll2025-10-29 13:24:19.637NT AUTHORITY\SYSTEM 11241100x800000000000000011203Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.651{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\endpointdlp.dll2025-10-29 13:24:19.651NT AUTHORITY\SYSTEM 11241100x800000000000000011204Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.671{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\x86\MpAsDesc.dll2025-10-29 13:24:19.669NT AUTHORITY\SYSTEM 11241100x800000000000000011205Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.676{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\x86\MpClient.dll2025-10-29 13:24:19.676NT AUTHORITY\SYSTEM 11241100x800000000000000011206Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.696{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\x86\MpDetours.dll2025-10-29 13:24:19.696NT AUTHORITY\SYSTEM 11241100x800000000000000011207Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.706{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\x86\MpDetoursCopyAccelerator.dll2025-10-29 13:24:19.706NT AUTHORITY\SYSTEM 11241100x800000000000000011208Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.714{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\x86\MpOAV.dll2025-10-29 13:24:19.714NT AUTHORITY\SYSTEM 11241100x800000000000000011209Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.724{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\x86\MsMpLics.dll2025-10-29 13:24:19.724NT AUTHORITY\SYSTEM 11241100x800000000000000011210Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:19.732{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\x86\endpointdlp.dll2025-10-29 13:24:19.732NT AUTHORITY\SYSTEM 11241100x800000000000000011211Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.754{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\ConfigSecurityPolicy.exe2025-10-29 13:24:19.752NT AUTHORITY\SYSTEM 11241100x800000000000000011212Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.767{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\DlpUserAgent.exe2025-10-29 13:24:19.767NT AUTHORITY\SYSTEM 11241100x800000000000000011213Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.776{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MipDlp.exe2025-10-29 13:24:19.776NT AUTHORITY\SYSTEM 11241100x800000000000000011214Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.790{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpCmdRun.exe2025-10-29 13:24:19.790NT AUTHORITY\SYSTEM 11241100x800000000000000011215Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.816{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpCopyAccelerator.exe2025-10-29 13:24:19.816NT AUTHORITY\SYSTEM 11241100x800000000000000011216Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.826{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpDefenderCoreService.exe2025-10-29 13:24:19.826NT AUTHORITY\SYSTEM 11241100x800000000000000011217Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.854{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpDlpCmd.exe2025-10-29 13:24:19.852NT AUTHORITY\SYSTEM 11241100x800000000000000011218Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.866{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpDlpService.exe2025-10-29 13:24:19.864NT AUTHORITY\SYSTEM 11241100x800000000000000011219Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.878{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpRecovery.exe2025-10-29 13:24:19.878NT AUTHORITY\SYSTEM 11241100x800000000000000011220Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.886{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpSigStub.exe2025-10-29 13:24:19.886NT AUTHORITY\SYSTEM 11241100x800000000000000011221Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.902{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MsMpEng.exe2025-10-29 13:24:19.902NT AUTHORITY\SYSTEM 11241100x800000000000000011222Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.910{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\NisSrv.exe2025-10-29 13:24:19.910NT AUTHORITY\SYSTEM 11241100x800000000000000011223Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.964{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\mpextms.exe2025-10-29 13:24:19.964NT AUTHORITY\SYSTEM 11241100x800000000000000011224Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:19.979{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\x86\MpCmdRun.exe2025-10-29 13:24:19.979NT AUTHORITY\SYSTEM 11241100x800000000000000011225Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:20.007{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\x86\MpCopyAccelerator.exe2025-10-29 13:24:20.005NT AUTHORITY\SYSTEM 11241100x800000000000000011226Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:21.526{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\Drivers\WdBoot.sys2025-10-29 13:24:21.526NT AUTHORITY\SYSTEM 11241100x800000000000000011227Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:21.540{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\Drivers\WdDevFlt.sys2025-10-29 13:24:21.540NT AUTHORITY\SYSTEM 11241100x800000000000000011228Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:21.572{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\Drivers\WdFilter.sys2025-10-29 13:24:21.572NT AUTHORITY\SYSTEM 11241100x800000000000000011229Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:21.629{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\Drivers\WdNisDrv.sys2025-10-29 13:24:21.629NT AUTHORITY\SYSTEM 11241100x800000000000000011230Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:21.657{8223a6b9-1582-6902-1402-000000002b00}8240C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\Drivers\ksld.sys2025-10-29 13:24:21.657NT AUTHORITY\SYSTEM 154100x800000000000000011231Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:21.752{8223a6b9-1585-6902-1502-000000002b00}8684C:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpSigStub.exe1.1.24010.2001 (7122f19e8a45ed98fbe41ea0bdadf251e45717f9)Microsoft Malware Protection Signature Update StubMicrosoft Malware ProtectionMicrosoft CorporationMpSigStub.exeC:\WINDOWS\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpSigStub.exe /stub 1.1.24010.2001 /payload 4.18.25090.3009 /program C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeC:\WINDOWS\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=71CF589293424C4389202C7F1752FB2D,SHA256=071B0D3A08503A8B88AEEDA1D20F371A563377028F6E252DC66CCE60AB8F823E,IMPHASH=73D10F665B566678AC1DDF9942FDAEA0{8223a6b9-1582-6902-1402-000000002b00}8240C:\Windows\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exe"C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exe" NT AUTHORITY\SYSTEM 154100x800000000000000011232Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:22.115{8223a6b9-1586-6902-1602-000000002b00}10636C:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpRecovery.exe4.18.25090.3009 (eca5bedb954af928bf12cba51015d5b3e0195e2e)Microsoft Malware Protection RecoveryMicrosoft® Windows® Operating SystemMicrosoft Corporationmprecovery.exeC:\WINDOWS\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpRecovery.exeC:\WINDOWS\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=F5F1F4AF401395AD76B7AD3AEDD6C744,SHA256=80DADD13D147E5C2E89B4671625468C087D8B773ED118C540426EBC2E04FCF5E,IMPHASH=6F16BF3C7540F752871993EB3657EA0F{8223a6b9-1585-6902-1502-000000002b00}8684C:\Windows\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpSigStub.exeC:\WINDOWS\SystemTemp\A9822913-9963-4D92-B409-1DE9A2D62759\MpSigStub.exe /stub 1.1.24010.2001 /payload 4.18.25090.3009 /program C:\WINDOWS\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011233Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:24:22.430{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\updateplatform.a|c79706282bf37b9f\LowerCaseLongPathc:\windows\softwaredistribution\download\install\updateplatform.amd64fre.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011234Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:24:22.430{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\updateplatform.a|c79706282bf37b9f\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000011235Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:24:22.430{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\updateplatform.a|c79706282bf37b9f\LinkDate09/30/2025 21:39:46NT AUTHORITY\SYSTEM 13241300x800000000000000011236Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:24:22.430{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\updateplatform.a|c79706282bf37b9f\BinProductVersion4.18.25090.3009NT AUTHORITY\SYSTEM 13241300x800000000000000011237Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:24:22.677{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpsigstub.exe|17fd0379f6e799cc\LowerCaseLongPathc:\windows\systemtemp\a9822913-9963-4d92-b409-1de9a2d62759\mpsigstub.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011238Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:24:22.677{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpsigstub.exe|17fd0379f6e799cc\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000011239Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:24:22.677{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpsigstub.exe|17fd0379f6e799cc\LinkDate03/07/2001 16:32:57NT AUTHORITY\SYSTEM 13241300x800000000000000011240Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:24:22.677{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpsigstub.exe|17fd0379f6e799cc\BinProductVersion1.1.24010.2001NT AUTHORITY\SYSTEM 13241300x800000000000000011241Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:24:22.683{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mprecovery.exe|3c211614389e76ed\LowerCaseLongPathc:\windows\systemtemp\a9822913-9963-4d92-b409-1de9a2d62759\mprecovery.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011242Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:24:22.683{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mprecovery.exe|3c211614389e76ed\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000011243Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:24:22.683{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mprecovery.exe|3c211614389e76ed\LinkDate10/03/2066 10:21:32NT AUTHORITY\SYSTEM 13241300x800000000000000011244Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:24:22.683{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mprecovery.exe|3c211614389e76ed\BinProductVersion4.18.25090.3009NT AUTHORITY\SYSTEM 11241100x800000000000000011245Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:22.903{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\ConfigSecurityPolicy.exe2025-10-29 13:24:22.901NT AUTHORITY\SYSTEM 11241100x800000000000000011246Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:22.919{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpAzSubmit.dll2025-10-29 13:24:22.919NT AUTHORITY\SYSTEM 11241100x800000000000000011247Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:22.929{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpClient.dll2025-10-29 13:24:22.929NT AUTHORITY\SYSTEM 11241100x800000000000000011248Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:22.939{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpCmdRun.exe2025-10-29 13:24:22.939NT AUTHORITY\SYSTEM 11241100x800000000000000011249Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:22.945{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpCommu.dll2025-10-29 13:24:22.945NT AUTHORITY\SYSTEM 11241100x800000000000000011250Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:22.955{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpDetours.dll2025-10-29 13:24:22.955NT AUTHORITY\SYSTEM 11241100x800000000000000011251Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:22.955{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpDetoursCopyAccelerator.dll2025-10-29 13:24:22.955NT AUTHORITY\SYSTEM 11241100x800000000000000011252Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:22.960{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpCopyAccelerator.exe2025-10-29 13:24:22.960NT AUTHORITY\SYSTEM 11241100x800000000000000011253Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:22.960{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpOAV.dll2025-10-29 13:24:22.960NT AUTHORITY\SYSTEM 11241100x800000000000000011254Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:22.971{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpRtp.dll2025-10-29 13:24:22.960NT AUTHORITY\SYSTEM 11241100x800000000000000011255Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:22.971{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpDlp.dll2025-10-29 13:24:22.971NT AUTHORITY\SYSTEM 11241100x800000000000000011256Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:22.986{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NpRep.dll2025-10-29 13:24:22.986NT AUTHORITY\SYSTEM 11241100x800000000000000011257Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.002{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpSvc.dll2025-10-29 13:24:23.002NT AUTHORITY\SYSTEM 11241100x800000000000000011258Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.042{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpUpdate.dll2025-10-29 13:24:23.042NT AUTHORITY\SYSTEM 11241100x800000000000000011259Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:23.046{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe2025-10-29 13:24:23.046NT AUTHORITY\SYSTEM 11241100x800000000000000011260Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.050{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpLics.dll2025-10-29 13:24:23.050NT AUTHORITY\SYSTEM 11241100x800000000000000011261Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:23.052{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\DlpUserAgent.exe2025-10-29 13:24:23.052NT AUTHORITY\SYSTEM 11241100x800000000000000011262Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:23.056{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MipDlp.exe2025-10-29 13:24:23.056NT AUTHORITY\SYSTEM 11241100x800000000000000011263Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:23.062{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe2025-10-29 13:24:23.062NT AUTHORITY\SYSTEM 11241100x800000000000000011264Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:23.082{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpDefenderCoreService.exe2025-10-29 13:24:23.082NT AUTHORITY\SYSTEM 11241100x800000000000000011265Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:23.098{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpDlpService.exe2025-10-29 13:24:23.098NT AUTHORITY\SYSTEM 11241100x800000000000000011266Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.104{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\DefenderCSP.dll2025-10-29 13:24:23.104NT AUTHORITY\SYSTEM 11241100x800000000000000011267Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:23.122{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Drivers\WdBoot.sys2025-10-29 13:24:23.122NT AUTHORITY\SYSTEM 11241100x800000000000000011268Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:23.124{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Drivers\WdDevFlt.sys2025-10-29 13:24:23.124NT AUTHORITY\SYSTEM 11241100x800000000000000011269Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:23.128{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Drivers\WdFilter.sys2025-10-29 13:24:23.128NT AUTHORITY\SYSTEM 11241100x800000000000000011270Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:23.134{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Drivers\WdNisDrv.sys2025-10-29 13:24:23.134NT AUTHORITY\SYSTEM 11241100x800000000000000011271Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.136{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\endpointdlp.dll2025-10-29 13:24:23.136NT AUTHORITY\SYSTEM 11241100x800000000000000011272Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.146{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpSenseComm.dll2025-10-29 13:24:23.146NT AUTHORITY\SYSTEM 11241100x800000000000000011273Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.146{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MdeDiag.dll2025-10-29 13:24:23.146NT AUTHORITY\SYSTEM 11241100x800000000000000011274Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:23.196{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpDlpCmd.exe2025-10-29 13:24:23.196NT AUTHORITY\SYSTEM 11241100x800000000000000011275Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.202{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpUxAgent.dll2025-10-29 13:24:23.202NT AUTHORITY\SYSTEM 13241300x800000000000000011276Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:23.383{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WdNisDrv\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x800000000000000011277Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:23.383{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WdNisDrv\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 11241100x800000000000000011278Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.394{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpAsDesc.dll2025-10-29 13:24:23.394NT AUTHORITY\SYSTEM 11241100x800000000000000011279Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.478{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpEvMsg.dll2025-10-29 13:24:23.478NT AUTHORITY\SYSTEM 11241100x800000000000000011280Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.534{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\ProtectionManagement.dll2025-10-29 13:24:23.534NT AUTHORITY\SYSTEM 11241100x800000000000000011281Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.557{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\X86\MpAsDesc.dll2025-10-29 13:24:23.557NT AUTHORITY\SYSTEM 11241100x800000000000000011282Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.574{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\X86\MpClient.dll2025-10-29 13:24:23.574NT AUTHORITY\SYSTEM 11241100x800000000000000011283Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:23.574{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\X86\MpCmdRun.exe2025-10-29 13:24:23.574NT AUTHORITY\SYSTEM 11241100x800000000000000011284Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.589{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\X86\MpDetours.dll2025-10-29 13:24:23.589NT AUTHORITY\SYSTEM 11241100x800000000000000011285Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.589{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\X86\MpDetoursCopyAccelerator.dll2025-10-29 13:24:23.589NT AUTHORITY\SYSTEM 11241100x800000000000000011286Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.589{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\X86\endpointdlp.dll2025-10-29 13:24:23.589NT AUTHORITY\SYSTEM 11241100x800000000000000011287Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.605{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\X86\MpOAV.dll2025-10-29 13:24:23.605NT AUTHORITY\SYSTEM 11241100x800000000000000011288Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.605{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\X86\MsMpLics.dll2025-10-29 13:24:23.605NT AUTHORITY\SYSTEM 11241100x800000000000000011289Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:23.605{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MipDlp.dll2025-10-29 13:24:23.605NT AUTHORITY\SYSTEM 11241100x800000000000000011290Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:23.787{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\mpextms.exe2025-10-29 13:24:23.787NT AUTHORITY\SYSTEM 11241100x800000000000000011291Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:23.801{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Drivers\ksld.sys2025-10-29 13:24:23.801NT AUTHORITY\SYSTEM 13241300x800000000000000011292Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:23.827{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\KslD\StartDWORD (0x00000004)NT AUTHORITY\SYSTEM 154100x800000000000000011293Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:23.832{8223a6b9-1587-6902-1702-000000002b00}3196C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" -RestartServiceC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4B730D779E8FFFAAD3320C097BE2B067,SHA256=A4291C5B4325895D13D32E232BF50C1B41356306803AC5DC75BBA9AECB021141,IMPHASH=E0220E5B585FC612AF76A6608C817F84{8223a6b9-1318-6902-5c00-000000002b00}4216C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x800000000000000011294Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:23.995{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WdNisDrv\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 154100x800000000000000011295Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:24.162{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Antimalware Service ExecutableMicrosoft® Windows® Operating SystemMicrosoft CorporationMsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=77E9CCBB8335BA5D4345447BA5B6121D,SHA256=C02655606C199BA276D2B01A796E6EBBA07A41EEDE9C85FE516D9A5851290155,IMPHASH=6D2BBFBF0C29D2CD8E6FD86A0206A516{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011296Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:24.947{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WdNisSvc\ImagePath"%%ProgramData%%\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011297Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:24.960{8223a6b9-1588-6902-1a02-000000002b00}5608C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-AMFilter.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011298Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:25.079{8223a6b9-1589-6902-1c02-000000002b00}2128C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-AMFilter.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Drivers\WdFilter.sys" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Drivers\WdFilter.sys" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Drivers\WdFilter.sys"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011299Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:25.144{8223a6b9-1589-6902-1e02-000000002b00}7788C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Windows-Windows Defender.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 12241200x800000000000000011300Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:24:25.215{8223a6b9-1589-6902-1e02-000000002b00}7788C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/OperationalNT AUTHORITY\SYSTEM 12241200x800000000000000011301Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:24:25.247{8223a6b9-1589-6902-1e02-000000002b00}7788C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHCNT AUTHORITY\SYSTEM 154100x800000000000000011302Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:25.264{8223a6b9-1589-6902-2002-000000002b00}10956C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Windows-Windows Defender.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpEvMsg.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpEvMsg.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpEvMsg.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x800000000000000011303Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\OwningPublisher{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}NT AUTHORITY\SYSTEM 13241300x800000000000000011304Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\EnabledDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000011305Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\IsolationDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000011306Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\ChannelAccessO:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)NT AUTHORITY\SYSTEM 13241300x800000000000000011307Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\MaxSizeDWORD (0x01000000)NT AUTHORITY\SYSTEM 13241300x800000000000000011308Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\MaxSizeUpperDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000011309Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\TypeDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000011310Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\OwningPublisher{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}NT AUTHORITY\SYSTEM 13241300x800000000000000011311Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\EnabledDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000011312Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\IsolationDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000011313Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ChannelAccessO:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)NT AUTHORITY\SYSTEM 13241300x800000000000000011314Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSizeDWORD (0x00040000)NT AUTHORITY\SYSTEM 13241300x800000000000000011315Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSizeUpperDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000011316Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:25.327{8223a6b9-1589-6902-2002-000000002b00}10956C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\TypeDWORD (0x00000001)NT AUTHORITY\SYSTEM 154100x800000000000000011317Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:25.649{8223a6b9-1589-6902-2202-000000002b00}10412C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-Service.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011318Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:25.709{8223a6b9-1589-6902-2402-000000002b00}440C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-Service.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpSvc.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpSvc.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpSvc.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011319Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:25.779{8223a6b9-1589-6902-2602-000000002b00}10196C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-NIS.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011320Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:25.820{8223a6b9-1589-6902-2802-000000002b00}8776C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-NIS.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011321Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:25.877{8223a6b9-1589-6902-2a02-000000002b00}4100C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-RTP.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011322Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:25.949{8223a6b9-1589-6902-2c02-000000002b00}3984C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-RTP.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpRtp.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpRtp.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpRtp.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011323Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.017{8223a6b9-158a-6902-2e02-000000002b00}6896C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-Protection.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011324Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.137{8223a6b9-158a-6902-3002-000000002b00}11812C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-Protection.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpClient.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpClient.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpClient.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x800000000000000011325Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:24:26.184{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeHKCR\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\(Default)"%%ProgramData%%\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpOav.dll"NT AUTHORITY\SYSTEM 13241300x800000000000000011326Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:24:26.184{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeHKCR\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\(Default)"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\X86\MpOav.dll"NT AUTHORITY\SYSTEM 13241300x800000000000000011327Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeHKCR\CLSID\{2DCD7FDB-8809-48E4-8E4F-3157C57CF987}\InprocServer32\(Default)C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MPUXAGENT.DLLNT AUTHORITY\SYSTEM 13241300x800000000000000011328Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeHKCR\CLSID\{4DB116D1-9B24-4DFC-946B-BFE03E852002}\InProcServer32\(Default)C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MPUXAGENT.DLLNT AUTHORITY\SYSTEM 13241300x800000000000000011329Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeHKCR\CLSID\{195B4D07-3DE2-4744-BBF2-D90121AE785B}\InprocServer32\(Default)"%%ProgramData%%\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\DefenderCSP.dll"NT AUTHORITY\SYSTEM 11241100x800000000000000011330Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefender\ConfigDefender.psd12024-11-17 14:06:32.792NT AUTHORITY\SYSTEM 11241100x800000000000000011331Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefender\MSFT_MpComputerStatus.cdxml2024-11-17 14:06:32.792NT AUTHORITY\SYSTEM 11241100x800000000000000011332Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefender\MSFT_MpThreat.cdxml2024-11-17 14:06:32.792NT AUTHORITY\SYSTEM 11241100x800000000000000011333Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefender\MSFT_MpThreatCatalog.cdxml2024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 11241100x800000000000000011334Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefender\MSFT_MpThreatDetection.cdxml2024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 11241100x800000000000000011335Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefender\MSFT_MpPreference.cdxml2024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 11241100x800000000000000011336Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefender\MSFT_MpBehavioralNetworkBlockingRules.cdxml2024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 11241100x800000000000000011337Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefender\MSFT_MpScan.cdxml2024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 11241100x800000000000000011338Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefender\MSFT_MpWDOScan.cdxml2024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 11241100x800000000000000011339Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefender\MSFT_MpSignature.cdxml2024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 11241100x800000000000000011340Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefender\MSFT_MpRollback.cdxml2024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 11241100x800000000000000011341Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefenderPerformance\ConfigDefenderPerformance.psd12024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 11241100x800000000000000011342Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefenderPerformance\MSFT_MpPerformanceRecording.psm12024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 11241100x800000000000000011343Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefenderPerformance\MSFT_MpPerformanceRecording.wprp2024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 11241100x800000000000000011344Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.200{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeC:\Windows\System32\WindowsPowerShell\v1.0\Modules\ConfigDefenderPerformance\MSFT_MpPerformanceReport.Format.ps1xml2024-11-17 14:06:32.794NT AUTHORITY\SYSTEM 154100x800000000000000011345Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.217{8223a6b9-158a-6902-3202-000000002b00}4444C:\Windows\System32\wbem\mofcomp.exe10.0.26100.4202 (WinBuild.160101.0800)The Managed Object Format (MOF) Compiler Microsoft® Windows® Operating SystemMicrosoft Corporationmofcomp.exeC:\WINDOWS\system32\wbem\mofcomp.exe "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\ProtectionManagement.mof"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=CE2EFFFCD373A28AF43E32AC86374C16,SHA256=C6BFC677DCC72782429BCDAC4A489546F488A8C545051A16B926446300BF3F05,IMPHASH=33E29380499B6B413B576B5B4927D346{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x800000000000000011346Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:24:26.391{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exeHKCR\CLSID\{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}\InprocServer32\(Default)"%%ProgramData%%\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\ProtectionManagement.dll"NT AUTHORITY\SYSTEM 154100x800000000000000011347Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.402{8223a6b9-158a-6902-3402-000000002b00}1088C:\Windows\System32\taskkill.exe10.0.26100.1 (WinBuild.160101.0800)Terminates ProcessesMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskkill.exeC:\WINDOWS\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=CBF904BC6835B56A4BD5AC4141F8D131,SHA256=1249717315FC8F4D2DF17D5DB9DA0444795FDB9FB83DFB1F763C3F39282244F7,IMPHASH=FFE513AF7F8477FE56A2B3C63BE2D148{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x800000000000000011348Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:26.477{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\MDCoreSvc\ImagePath"%%ProgramData%%\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpDefenderCoreService.exe"NT AUTHORITY\SYSTEM 13241300x800000000000000011349Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:26.477{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\MDCoreSvc\StartDWORD (0x00000002)NT AUTHORITY\SYSTEM 154100x800000000000000011350Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.486{8223a6b9-158a-6902-3602-000000002b00}6480C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpDefenderCoreService.exe4.18.25090.3009 (eca5bedb954af928bf12cba51015d5b3e0195e2e)Antimalware Core ServiceMicrosoft® Windows® Operating SystemMicrosoft CorporationMpDefenderCoreService.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpDefenderCoreService.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=B5CB6FA557506DA9729527D8B49C77A3,SHA256=1732632B30B27DFE458F0F6D05F4E50B7DD6CCD892ADC9ABA091446BEBE2200B,IMPHASH=3B718699E3114A2EC08F4D6A06959E8A{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x800000000000000011351Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.510{8223a6b9-158a-6902-3702-000000002b00}6084C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\system32\svchost.exe -k GPSvcGroupC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011352Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:26.511{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WinDefend\ImagePath"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011353Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.520{8223a6b9-158a-6902-3802-000000002b00}10872C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" -RestartServiceC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4B730D779E8FFFAAD3320C097BE2B067,SHA256=A4291C5B4325895D13D32E232BF50C1B41356306803AC5DC75BBA9AECB021141,IMPHASH=E0220E5B585FC612AF76A6608C817F84{8223a6b9-1588-6902-1902-000000002b00}5072C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011354Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.585{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe4.18.25090.3009 (eca5bedb954af928bf12cba51015d5b3e0195e2e)Antimalware Service ExecutableMicrosoft® Windows® Operating SystemMicrosoft CorporationMsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=05BFF37CEAB240F0EE39B43A5D132F35,SHA256=C8F990145359081D2D2FD616D8BF2F1E82FEF822B10A2DC6FF82E66630CDEE16,IMPHASH=6D2BBFBF0C29D2CD8E6FD86A0206A516{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x800000000000000011355Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.749{8223a6b9-158a-6902-3b02-000000002b00}8432C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-AMFilter.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011356Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.864{8223a6b9-158a-6902-3d02-000000002b00}6928C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-AMFilter.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Drivers\WdFilter.sys" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Drivers\WdFilter.sys" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Drivers\WdFilter.sys"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011357Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:26.932{8223a6b9-158a-6902-3f02-000000002b00}3116C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Windows-Windows Defender.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 12241200x800000000000000011358Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:24:27.005{8223a6b9-158a-6902-3f02-000000002b00}3116C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/OperationalNT AUTHORITY\SYSTEM 12241200x800000000000000011359Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:24:27.024{8223a6b9-158a-6902-3f02-000000002b00}3116C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHCNT AUTHORITY\SYSTEM 154100x800000000000000011360Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:27.033{8223a6b9-158b-6902-4102-000000002b00}6516C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Windows-Windows Defender.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpEvMsg.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpEvMsg.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpEvMsg.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x800000000000000011361Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:24:27.078{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msmpeng.exe|29ef5a9427e6f197\LowerCaseLongPathc:\programdata\microsoft\windows defender\platform\4.18.25090.3009-0\msmpeng.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011362Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:24:27.078{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msmpeng.exe|29ef5a9427e6f197\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000011363Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:24:27.078{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msmpeng.exe|29ef5a9427e6f197\LinkDate03/26/1997 13:30:22NT AUTHORITY\SYSTEM 13241300x800000000000000011364Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:24:27.078{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\msmpeng.exe|29ef5a9427e6f197\BinProductVersion4.18.25090.3009NT AUTHORITY\SYSTEM 13241300x800000000000000011365Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\OwningPublisher{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}NT AUTHORITY\SYSTEM 13241300x800000000000000011366Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\EnabledDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000011367Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\IsolationDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000011368Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\ChannelAccessO:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)NT AUTHORITY\SYSTEM 13241300x800000000000000011369Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\MaxSizeDWORD (0x01000000)NT AUTHORITY\SYSTEM 13241300x800000000000000011370Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\MaxSizeUpperDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000011371Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\TypeDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000011372Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\OwningPublisher{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}NT AUTHORITY\SYSTEM 13241300x800000000000000011373Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\EnabledDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000011374Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\IsolationDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000011375Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ChannelAccessO:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)NT AUTHORITY\SYSTEM 13241300x800000000000000011376Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSizeDWORD (0x00040000)NT AUTHORITY\SYSTEM 13241300x800000000000000011377Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSizeUpperDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000011378Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.099{8223a6b9-158b-6902-4102-000000002b00}6516C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\TypeDWORD (0x00000001)NT AUTHORITY\SYSTEM 154100x800000000000000011379Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:27.411{8223a6b9-158b-6902-4302-000000002b00}6932C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-Service.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011380Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:27.474{8223a6b9-158b-6902-4502-000000002b00}7116C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-Service.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpSvc.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpSvc.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpSvc.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011381Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:27.539{8223a6b9-158b-6902-4702-000000002b00}10572C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-NIS.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011382Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:27.585{8223a6b9-158b-6902-4902-000000002b00}2136C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-NIS.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011383Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:27.643{8223a6b9-158b-6902-4b02-000000002b00}12220C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-RTP.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011384Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:27.714{8223a6b9-158b-6902-4d02-000000002b00}7260C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-RTP.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpRtp.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpRtp.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpRtp.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011385Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:27.774{8223a6b9-158b-6902-4f02-000000002b00}2096C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe uninstall-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-Protection.man"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 154100x800000000000000011386Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:27.910{8223a6b9-158b-6902-5102-000000002b00}6804C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exeC:\WINDOWS\system32\wevtutil.exe install-manifest "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\Microsoft-Antimalware-Protection.man" "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpClient.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpClient.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpClient.dll"C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x800000000000000011387Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:24:27.974{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exeHKCR\CLSID\{2DCD7FDB-8809-48E4-8E4F-3157C57CF987}\InprocServer32\(Default)C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MPUXAGENT.DLLNT AUTHORITY\SYSTEM 13241300x800000000000000011388Microsoft-Windows-Sysmon/Operationalsoc101win11T1122SetValue2025-10-29 13:24:27.976{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exeHKCR\CLSID\{4DB116D1-9B24-4DFC-946B-BFE03E852002}\InProcServer32\(Default)C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MPUXAGENT.DLLNT AUTHORITY\SYSTEM 13241300x800000000000000011389Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:27.978{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\MDCoreSvc\StartDWORD (0x00000002)NT AUTHORITY\SYSTEM 13241300x800000000000000011390Microsoft-Windows-Sysmon/Operationalsoc101win11T1089,Tamper-DefenderSetValue2025-10-29 13:24:27.988{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exeHKLM\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpywareDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000011391Microsoft-Windows-Sysmon/Operationalsoc101win11T1089,Tamper-DefenderSetValue2025-10-29 13:24:27.988{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exeHKLM\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirusDWORD (0x00000000)NT AUTHORITY\SYSTEM 154100x800000000000000011392Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:27.990{8223a6b9-158b-6902-5302-000000002b00}3672C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe4.18.25080.5 (aec027e97d1d7ab25370672d0fb4548480483a83)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe" -EnableServiceC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4B730D779E8FFFAAD3320C097BE2B067,SHA256=A4291C5B4325895D13D32E232BF50C1B41356306803AC5DC75BBA9AECB021141,IMPHASH=E0220E5B585FC612AF76A6608C817F84{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x800000000000000011393Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.992{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exeHKCR\*\shellex\ContextMenuHandlers\EPP\(Default){09A47860-11B0-4DA5-AFA5-26D86198A780}NT AUTHORITY\SYSTEM 13241300x800000000000000011394Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.992{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exeHKCR\Drive\shellex\ContextMenuHandlers\EPP\(Default){09A47860-11B0-4DA5-AFA5-26D86198A780}NT AUTHORITY\SYSTEM 13241300x800000000000000011395Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:24:27.992{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exeHKCR\Directory\shellex\ContextMenuHandlers\EPP\(Default){09A47860-11B0-4DA5-AFA5-26D86198A780}NT AUTHORITY\SYSTEM 13241300x800000000000000011396Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:28.036{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WdFilter\StartDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000011397Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:28.036{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WdBoot\StartDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000011398Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:28.036{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WinDefend\StartDWORD (0x00000002)NT AUTHORITY\SYSTEM 13241300x800000000000000011399Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:28.101{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\KslD\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 13241300x800000000000000011400Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:28.101{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\KslD\ImagePathsystem32\drivers\wd\KslD.sysNT AUTHORITY\SYSTEM 154100x800000000000000011401Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:30.128{8223a6b9-158e-6902-5502-000000002b00}3984C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe10.0.27840.1000 (WinBuild.160101.0800)Windows Security Health HostMicrosoft® Windows® Operating SystemMicrosoft CorporationSecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=478FBFDA6A51CF9F0D5BFD50B72DFB08,SHA256=272896B88C6C30DD41E8D44FD54A676FDC6A675BE3F38AAA7434F51B98B822E0,IMPHASH=E8960CAF12CF621B3CA78988264C27F1{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 13241300x800000000000000011402Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:34.553{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\MDCoreSvc\StartDWORD (0x00000002)NT AUTHORITY\SYSTEM 13241300x800000000000000011403Microsoft-Windows-Sysmon/Operationalsoc101win11T1031,T1050SetValue2025-10-29 13:24:34.575{8223a6b9-1314-6902-0b00-000000002b00}832C:\WINDOWS\system32\services.exeHKLM\System\CurrentControlSet\Services\WdNisDrv\StartDWORD (0x00000003)NT AUTHORITY\SYSTEM 154100x800000000000000011404Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:34.736{8223a6b9-1592-6902-5602-000000002b00}3552C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe4.18.25090.3009 (eca5bedb954af928bf12cba51015d5b3e0195e2e)Microsoft Network Realtime Inspection ServiceMicrosoft® Windows® Operating SystemMicrosoft CorporationNisSrv.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe"C:\WINDOWS\system32\NT AUTHORITY\LOCAL SERVICE{8223a6b9-1316-6902-e503-000000000000}0x3e50SystemMD5=057F2B90813A4BB412DA71B99816B795,SHA256=1403C198C987F26E8C257CEF8B9826783B7438181E2CB062BA590BA383FEEDC9,IMPHASH=1DF092BD9A196CF019F35F9F3FEC51E5{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 11241100x800000000000000011405Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:43.180{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\nsExec.dll2025-10-29 13:24:43.180soc101win11\Administrator 254200x800000000000000011406Microsoft-Windows-Sysmon/Operationalsoc101win11T10992025-10-29 13:24:43.799{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\app-64.7z2025-10-18 17:42:28.0002025-10-29 13:24:43.276soc101win11\Administrator 11241100x800000000000000011407Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:43.803{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\nsis7z.dll2025-10-29 13:24:43.799soc101win11\Administrator 11241100x800000000000000011408Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:49.573{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\ctypes\macholib\fetch_macholib.bat2025-10-29 13:24:49.573soc101win11\Administrator 11241100x800000000000000011409Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:50.249{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\idlelib\idle.bat2025-10-29 13:24:50.249soc101win11\Administrator 11241100x800000000000000011410Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:50.783{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\venv\scripts\common\Activate.ps12025-10-29 13:24:50.783soc101win11\Administrator 11241100x800000000000000011411Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:50.785{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\venv\scripts\nt\activate.bat2025-10-29 13:24:50.785soc101win11\Administrator 11241100x800000000000000011412Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:50.787{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\venv\scripts\nt\deactivate.bat2025-10-29 13:24:50.787soc101win11\Administrator 11241100x800000000000000011413Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:55.389{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\main\native_modules\node-gyp-bin\node-gyp.cmd2025-10-29 13:24:55.389soc101win11\Administrator 11241100x800000000000000011414Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:24:55.391{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\main\native_modules\node-gyp-bin1\node-gyp.cmd2025-10-29 13:24:55.391soc101win11\Administrator 11241100x800000000000000011415Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:57.838{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\d3dcompiler_47.dll2025-10-29 13:24:57.838soc101win11\Administrator 11241100x800000000000000011416Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:57.958{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\ffmpeg.dll2025-10-29 13:24:57.958soc101win11\Administrator 11241100x800000000000000011417Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:58.043{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\libEGL.dll2025-10-29 13:24:58.043soc101win11\Administrator 11241100x800000000000000011418Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:24:58.049{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\libGLESv2.dll2025-10-29 13:24:58.049soc101win11\Administrator 11241100x800000000000000011419Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:24:58.235{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\LM Studio.exe2025-10-29 13:24:58.235soc101win11\Administrator 11241100x800000000000000011420Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:02.894{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\deno.exe2025-10-29 13:25:02.894soc101win11\Administrator 11241100x800000000000000011421Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:04.356{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\esbuild.exe2025-10-29 13:25:04.356soc101win11\Administrator 11241100x800000000000000011422Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.549{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\ggml-base.dll2025-10-29 13:25:04.547soc101win11\Administrator 11241100x800000000000000011423Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.557{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\ggml-cpu.dll2025-10-29 13:25:04.557soc101win11\Administrator 11241100x800000000000000011424Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.577{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\ggml_llamacpp.dll2025-10-29 13:25:04.577soc101win11\Administrator 11241100x800000000000000011425Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.578{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\llama.dll2025-10-29 13:25:04.577soc101win11\Administrator 11241100x800000000000000011426Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.616{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\llm_engine.dll2025-10-29 13:25:04.616soc101win11\Administrator 11241100x800000000000000011427Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.628{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\lmstudiocore.dll2025-10-29 13:25:04.628soc101win11\Administrator 11241100x800000000000000011428Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.640{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\MSVCP140.dll2025-10-29 13:25:04.640soc101win11\Administrator 11241100x800000000000000011429Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.652{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\mtmd.dll2025-10-29 13:25:04.652soc101win11\Administrator 11241100x800000000000000011430Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.665{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\VCOMP140.dll2025-10-29 13:25:04.665soc101win11\Administrator 11241100x800000000000000011431Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.669{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\VCRUNTIME140.dll2025-10-29 13:25:04.667soc101win11\Administrator 11241100x800000000000000011432Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.669{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\VCRUNTIME140_1.dll2025-10-29 13:25:04.669soc101win11\Administrator 11241100x800000000000000011433Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.671{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\ggml-base.dll2025-10-29 13:25:04.671soc101win11\Administrator 11241100x800000000000000011434Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.691{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\ggml-cpu.dll2025-10-29 13:25:04.691soc101win11\Administrator 11241100x800000000000000011435Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:04.701{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\ggml-cuda.dll2025-10-29 13:25:04.701soc101win11\Administrator 154100x800000000000000011436Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:05.411{8223a6b9-15b1-6902-5702-000000002b00}7720C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe10.0.27840.1000 (WinBuild.160101.0800)Windows Security Health HostMicrosoft® Windows® Operating SystemMicrosoft CorporationSecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=478FBFDA6A51CF9F0D5BFD50B72DFB08,SHA256=272896B88C6C30DD41E8D44FD54A676FDC6A675BE3F38AAA7434F51B98B822E0,IMPHASH=E8960CAF12CF621B3CA78988264C27F1{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 11241100x800000000000000011437Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.809{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\ggml_llamacpp.dll2025-10-29 13:25:08.809soc101win11\Administrator 11241100x800000000000000011438Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.811{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\libomp.dll2025-10-29 13:25:08.811soc101win11\Administrator 11241100x800000000000000011439Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.819{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\llama.dll2025-10-29 13:25:08.819soc101win11\Administrator 11241100x800000000000000011440Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.853{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\llm_engine.dll2025-10-29 13:25:08.853soc101win11\Administrator 11241100x800000000000000011441Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.880{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\lmstudiocore.dll2025-10-29 13:25:08.880soc101win11\Administrator 11241100x800000000000000011442Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.888{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\MSVCP140.dll2025-10-29 13:25:08.886soc101win11\Administrator 11241100x800000000000000011443Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.902{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\mtmd.dll2025-10-29 13:25:08.900soc101win11\Administrator 11241100x800000000000000011444Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.926{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\VCRUNTIME140.dll2025-10-29 13:25:08.924soc101win11\Administrator 11241100x800000000000000011445Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.928{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\VCRUNTIME140_1.dll2025-10-29 13:25:08.928soc101win11\Administrator 11241100x800000000000000011446Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.928{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\ggml-base.dll2025-10-29 13:25:08.928soc101win11\Administrator 11241100x800000000000000011447Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.936{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\ggml-cpu.dll2025-10-29 13:25:08.936soc101win11\Administrator 11241100x800000000000000011448Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:08.950{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\ggml-vulkan.dll2025-10-29 13:25:08.948soc101win11\Administrator 11241100x800000000000000011449Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:09.189{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\ggml_llamacpp.dll2025-10-29 13:25:09.189soc101win11\Administrator 11241100x800000000000000011450Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:09.191{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\llama.dll2025-10-29 13:25:09.191soc101win11\Administrator 11241100x800000000000000011451Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:09.221{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\llm_engine.dll2025-10-29 13:25:09.219soc101win11\Administrator 11241100x800000000000000011452Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:09.231{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\lmstudiocore.dll2025-10-29 13:25:09.231soc101win11\Administrator 11241100x800000000000000011453Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:09.234{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\MSVCP140.dll2025-10-29 13:25:09.234soc101win11\Administrator 11241100x800000000000000011454Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:09.245{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\mtmd.dll2025-10-29 13:25:09.245soc101win11\Administrator 11241100x800000000000000011455Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:09.254{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\VCOMP140.dll2025-10-29 13:25:09.254soc101win11\Administrator 11241100x800000000000000011456Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:09.256{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\VCRUNTIME140.dll2025-10-29 13:25:09.256soc101win11\Administrator 11241100x800000000000000011457Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:09.258{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\VCRUNTIME140_1.dll2025-10-29 13:25:09.258soc101win11\Administrator 11241100x800000000000000011458Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:09.260{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\win-llama-cuda-vendor-v2\cublas64_11.dll2025-10-29 13:25:09.260soc101win11\Administrator 11241100x800000000000000011459Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:12.885{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\win-llama-cuda-vendor-v2\cublasLt64_11.dll2025-10-29 13:25:12.885soc101win11\Administrator 11241100x800000000000000011460Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.203{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\win-llama-cuda-vendor-v2\cudart64_110.dll2025-10-29 13:25:20.203soc101win11\Administrator 11241100x800000000000000011461Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.212{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\win-llama-vulkan-vendor-v2\vulkan-1.dll2025-10-29 13:25:20.212soc101win11\Administrator 11241100x800000000000000011462Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:20.234{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\Scripts\python.exe2025-10-29 13:25:20.234soc101win11\Administrator 11241100x800000000000000011463Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:20.236{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\Scripts\pythonw.exe2025-10-29 13:25:20.236soc101win11\Administrator 11241100x800000000000000011464Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.240{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\libcrypto-3-x64.dll2025-10-29 13:25:20.240soc101win11\Administrator 11241100x800000000000000011465Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.320{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\libffi-8.dll2025-10-29 13:25:20.320soc101win11\Administrator 11241100x800000000000000011466Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.320{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\libssl-3-x64.dll2025-10-29 13:25:20.320soc101win11\Administrator 11241100x800000000000000011467Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.335{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\sqlite3.dll2025-10-29 13:25:20.335soc101win11\Administrator 11241100x800000000000000011468Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.375{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\tcl86t.dll2025-10-29 13:25:20.375soc101win11\Administrator 11241100x800000000000000011469Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.411{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\tk86t.dll2025-10-29 13:25:20.411soc101win11\Administrator 11241100x800000000000000011470Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:20.435{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\venv\scripts\nt\python.exe2025-10-29 13:25:20.435soc101win11\Administrator 11241100x800000000000000011471Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:20.443{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\venv\scripts\nt\pythonw.exe2025-10-29 13:25:20.441soc101win11\Administrator 11241100x800000000000000011472Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:20.445{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe2025-10-29 13:25:20.445soc101win11\Administrator 11241100x800000000000000011473Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.447{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python3.dll2025-10-29 13:25:20.447soc101win11\Administrator 11241100x800000000000000011474Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.449{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python311.dll2025-10-29 13:25:20.449soc101win11\Administrator 11241100x800000000000000011475Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:20.522{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\pythonw.exe2025-10-29 13:25:20.522soc101win11\Administrator 11241100x800000000000000011476Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.530{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\tcl\dde1.4\tcldde14.dll2025-10-29 13:25:20.529soc101win11\Administrator 11241100x800000000000000011477Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.532{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\tcl\reg1.3\tclreg13.dll2025-10-29 13:25:20.532soc101win11\Administrator 11241100x800000000000000011478Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.534{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\tcl\tix8.4.3\tix84.dll2025-10-29 13:25:20.534soc101win11\Administrator 11241100x800000000000000011479Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.538{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\vcruntime140.dll2025-10-29 13:25:20.538soc101win11\Administrator 11241100x800000000000000011480Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.542{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\vcruntime140_1.dll2025-10-29 13:25:20.542soc101win11\Administrator 11241100x800000000000000011481Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.544{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\liblmstudio\cpu\lmstudiocore.dll2025-10-29 13:25:20.544soc101win11\Administrator 11241100x800000000000000011482Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.548{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\liblmstudio\vulkan\lmstudiocore.dll2025-10-29 13:25:20.548soc101win11\Administrator 11241100x800000000000000011483Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:20.552{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\liblmstudio\vulkan\vulkan-1.dll2025-10-29 13:25:20.552soc101win11\Administrator 11241100x800000000000000011484Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:20.560{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\node.exe2025-10-29 13:25:20.560soc101win11\Administrator 11241100x800000000000000011485Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:21.517{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\bin\sqlite-vector.dll2025-10-29 13:25:21.517soc101win11\Administrator 11241100x800000000000000011486Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:21.517{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\lib\libvips-42.dll2025-10-29 13:25:21.517soc101win11\Administrator 11241100x800000000000000011487Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:21.843{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\lib\libvips-cpp.dll2025-10-29 13:25:21.843soc101win11\Administrator 11241100x800000000000000011488Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:21.849{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\app\.webpack\lms.exe2025-10-29 13:25:21.849soc101win11\Administrator 11241100x800000000000000011489Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:22.921{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\resources\elevate.exe2025-10-29 13:25:22.921soc101win11\Administrator 11241100x800000000000000011490Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:22.931{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\vk_swiftshader.dll2025-10-29 13:25:22.931soc101win11\Administrator 11241100x800000000000000011491Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:23.003{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\7z-out\vulkan-1.dll2025-10-29 13:25:23.003soc101win11\Administrator 11241100x800000000000000011492Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:23.273{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\d3dcompiler_47.dll2025-10-29 13:25:23.271soc101win11\Administrator 11241100x800000000000000011493Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:23.279{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\ffmpeg.dll2025-10-29 13:25:23.277soc101win11\Administrator 11241100x800000000000000011494Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:23.293{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\libEGL.dll2025-10-29 13:25:23.293soc101win11\Administrator 11241100x800000000000000011495Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:23.299{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\libGLESv2.dll2025-10-29 13:25:23.299soc101win11\Administrator 11241100x800000000000000011496Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:23.324{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe2025-10-29 13:25:23.324soc101win11\Administrator 11241100x800000000000000011497Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:23.863{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\vk_swiftshader.dll2025-10-29 13:25:23.863soc101win11\Administrator 11241100x800000000000000011498Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:23.885{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\vulkan-1.dll2025-10-29 13:25:23.885soc101win11\Administrator 13241300x800000000000000011499Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:25:23.895{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFFBinary Datasoc101win11\Administrator 11241100x800000000000000011500Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:24.162{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\elevate.exe2025-10-29 13:25:24.162soc101win11\Administrator 11241100x800000000000000011501Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:24.234{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\lms.exe2025-10-29 13:25:24.234soc101win11\Administrator 11241100x800000000000000011502Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:24.436{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\deno.exe2025-10-29 13:25:24.436soc101win11\Administrator 11241100x800000000000000011503Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:24.697{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\esbuild.exe2025-10-29 13:25:24.697soc101win11\Administrator 11241100x800000000000000011504Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:24.739{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\node.exe2025-10-29 13:25:24.739soc101win11\Administrator 11241100x800000000000000011505Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:24.936{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\sqlite-vector.dll2025-10-29 13:25:24.936soc101win11\Administrator 11241100x800000000000000011506Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.198{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\ggml-base.dll2025-10-29 13:25:25.196soc101win11\Administrator 11241100x800000000000000011507Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.204{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\ggml-cpu.dll2025-10-29 13:25:25.202soc101win11\Administrator 11241100x800000000000000011508Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.208{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\ggml_llamacpp.dll2025-10-29 13:25:25.208soc101win11\Administrator 11241100x800000000000000011509Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.222{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\llama.dll2025-10-29 13:25:25.222soc101win11\Administrator 11241100x800000000000000011510Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.230{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\llm_engine.dll2025-10-29 13:25:25.230soc101win11\Administrator 11241100x800000000000000011511Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.242{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\lmstudiocore.dll2025-10-29 13:25:25.242soc101win11\Administrator 11241100x800000000000000011512Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.246{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\MSVCP140.dll2025-10-29 13:25:25.246soc101win11\Administrator 11241100x800000000000000011513Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.252{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\mtmd.dll2025-10-29 13:25:25.252soc101win11\Administrator 11241100x800000000000000011514Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.258{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\VCOMP140.dll2025-10-29 13:25:25.258soc101win11\Administrator 11241100x800000000000000011515Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.262{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\VCRUNTIME140.dll2025-10-29 13:25:25.262soc101win11\Administrator 11241100x800000000000000011516Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.266{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-avx2-1.52.1\VCRUNTIME140_1.dll2025-10-29 13:25:25.266soc101win11\Administrator 11241100x800000000000000011517Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.288{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\ggml-base.dll2025-10-29 13:25:25.286soc101win11\Administrator 11241100x800000000000000011518Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.298{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\ggml-cpu.dll2025-10-29 13:25:25.298soc101win11\Administrator 11241100x800000000000000011519Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:25.306{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\ggml-cuda.dll2025-10-29 13:25:25.306soc101win11\Administrator 11241100x800000000000000011520Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.472{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\ggml_llamacpp.dll2025-10-29 13:25:26.472soc101win11\Administrator 11241100x800000000000000011521Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.480{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\libomp.dll2025-10-29 13:25:26.480soc101win11\Administrator 11241100x800000000000000011522Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.486{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\llama.dll2025-10-29 13:25:26.486soc101win11\Administrator 11241100x800000000000000011523Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.494{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\llm_engine.dll2025-10-29 13:25:26.494soc101win11\Administrator 11241100x800000000000000011524Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.504{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\lmstudiocore.dll2025-10-29 13:25:26.504soc101win11\Administrator 11241100x800000000000000011525Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.508{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\MSVCP140.dll2025-10-29 13:25:26.508soc101win11\Administrator 11241100x800000000000000011526Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.514{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\mtmd.dll2025-10-29 13:25:26.514soc101win11\Administrator 11241100x800000000000000011527Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.518{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\VCRUNTIME140.dll2025-10-29 13:25:26.518soc101win11\Administrator 11241100x800000000000000011528Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.522{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-nvidia-cuda-avx2-1.52.1\VCRUNTIME140_1.dll2025-10-29 13:25:26.522soc101win11\Administrator 11241100x800000000000000011529Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.540{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\ggml-base.dll2025-10-29 13:25:26.538soc101win11\Administrator 11241100x800000000000000011530Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.544{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\ggml-cpu.dll2025-10-29 13:25:26.544soc101win11\Administrator 11241100x800000000000000011531Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.550{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\ggml-vulkan.dll2025-10-29 13:25:26.550soc101win11\Administrator 11241100x800000000000000011532Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.675{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\ggml_llamacpp.dll2025-10-29 13:25:26.675soc101win11\Administrator 11241100x800000000000000011533Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.685{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\llama.dll2025-10-29 13:25:26.685soc101win11\Administrator 11241100x800000000000000011534Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.695{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\llm_engine.dll2025-10-29 13:25:26.695soc101win11\Administrator 11241100x800000000000000011535Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.707{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\lmstudiocore.dll2025-10-29 13:25:26.707soc101win11\Administrator 11241100x800000000000000011536Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.715{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\MSVCP140.dll2025-10-29 13:25:26.715soc101win11\Administrator 11241100x800000000000000011537Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.721{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\mtmd.dll2025-10-29 13:25:26.721soc101win11\Administrator 11241100x800000000000000011538Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.727{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\VCOMP140.dll2025-10-29 13:25:26.727soc101win11\Administrator 11241100x800000000000000011539Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.731{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\VCRUNTIME140.dll2025-10-29 13:25:26.731soc101win11\Administrator 11241100x800000000000000011540Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.735{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\llama.cpp-win-x86_64-vulkan-avx2-1.52.1\VCRUNTIME140_1.dll2025-10-29 13:25:26.735soc101win11\Administrator 11241100x800000000000000011541Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:26.747{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\win-llama-cuda-vendor-v2\cublas64_11.dll2025-10-29 13:25:26.747soc101win11\Administrator 11241100x800000000000000011542Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:27.150{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\win-llama-cuda-vendor-v2\cublasLt64_11.dll2025-10-29 13:25:27.148soc101win11\Administrator 11241100x800000000000000011543Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:28.049{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\win-llama-cuda-vendor-v2\cudart64_110.dll2025-10-29 13:25:28.047soc101win11\Administrator 11241100x800000000000000011544Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:28.059{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\win-llama-vulkan-vendor-v2\vulkan-1.dll2025-10-29 13:25:28.059soc101win11\Administrator 11241100x800000000000000011545Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:29.341{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\Scripts\python.exe2025-10-29 13:25:29.341soc101win11\Administrator 11241100x800000000000000011546Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:29.347{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\Scripts\pythonw.exe2025-10-29 13:25:29.347soc101win11\Administrator 11241100x800000000000000011547Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:29.376{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe2025-10-29 13:25:29.376soc101win11\Administrator 11241100x800000000000000011548Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:29.380{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python3.dll2025-10-29 13:25:29.380soc101win11\Administrator 11241100x800000000000000011549Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:29.384{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python311.dll2025-10-29 13:25:29.384soc101win11\Administrator 11241100x800000000000000011550Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:29.394{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\pythonw.exe2025-10-29 13:25:29.394soc101win11\Administrator 11241100x800000000000000011551Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:29.396{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\vcruntime140.dll2025-10-29 13:25:29.396soc101win11\Administrator 11241100x800000000000000011552Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:29.400{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\vcruntime140_1.dll2025-10-29 13:25:29.400soc101win11\Administrator 11241100x800000000000000011553Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:29.406{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\libcrypto-3-x64.dll2025-10-29 13:25:29.406soc101win11\Administrator 11241100x800000000000000011554Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:29.424{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\libffi-8.dll2025-10-29 13:25:29.424soc101win11\Administrator 11241100x800000000000000011555Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:29.428{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\libssl-3-x64.dll2025-10-29 13:25:29.428soc101win11\Administrator 11241100x800000000000000011556Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:29.444{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\sqlite3.dll2025-10-29 13:25:29.444soc101win11\Administrator 11241100x800000000000000011557Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:29.452{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\tcl86t.dll2025-10-29 13:25:29.452soc101win11\Administrator 11241100x800000000000000011558Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:29.462{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\DLLs\tk86t.dll2025-10-29 13:25:29.462soc101win11\Administrator 11241100x800000000000000011559Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:31.433{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\ctypes\macholib\fetch_macholib.bat2025-10-29 13:25:31.433soc101win11\Administrator 22542200x800000000000000011560Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:30.582{8223a6b9-15c8-6902-5b02-000000002b00}6292soc101win110fe80::a832:a53b:32c1:6645;::ffff:172.16.143.133;C:\Windows\System32\CompatTelRunner.exeNT AUTHORITY\SYSTEM 11241100x800000000000000011561Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:32.529{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\idlelib\idle.bat2025-10-29 13:25:32.529soc101win11\Administrator 11241100x800000000000000011562Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:33.737{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\venv\scripts\common\Activate.ps12025-10-29 13:25:33.737soc101win11\Administrator 11241100x800000000000000011563Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:33.745{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\venv\scripts\nt\activate.bat2025-10-29 13:25:33.745soc101win11\Administrator 11241100x800000000000000011564Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:33.749{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\venv\scripts\nt\deactivate.bat2025-10-29 13:25:33.749soc101win11\Administrator 11241100x800000000000000011565Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:33.753{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\venv\scripts\nt\python.exe2025-10-29 13:25:33.753soc101win11\Administrator 11241100x800000000000000011566Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:33.759{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\Lib\venv\scripts\nt\pythonw.exe2025-10-29 13:25:33.759soc101win11\Administrator 11241100x800000000000000011567Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:34.180{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\tcl\dde1.4\tcldde14.dll2025-10-29 13:25:34.180soc101win11\Administrator 11241100x800000000000000011568Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:34.223{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\tcl\reg1.3\tclreg13.dll2025-10-29 13:25:34.223soc101win11\Administrator 11241100x800000000000000011569Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:38.042{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\tcl\tix8.4.3\tix84.dll2025-10-29 13:25:38.042soc101win11\Administrator C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=BD542C1197F3B5217B5C5B5C4A25BD0C,SHA256=75F490D70F821AFBBBB28D8AE45FA712C0EF39F73832AF5FF0DF284BEB22A9FC,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77{8223a6b9-15c8-6902-5b02-000000002b00}6292C:\Windows\System32\CompatTelRunner.exeC:\WINDOWS\system32\compattelrunner.exe -cv:CFtwuJIl6U2RpFVm.0.6 -wce:0000000000000228 -m:appraiser.dll -f:DoScheduledTelemetryRun NT AUTHORITY\SYSTEM Write-Host 'Final result:',$isBroken } } } break $isBroken = if ((Get-ItemPropertyValue -Path ($bagRoot + '\' + $nodeSlot + '\Shell\*') -Name 'GroupView') -eq 0) { 1 } else { 0 } $nodeSlot = Get-ItemPropertyValue -Path ($bagMRURoot + '\' + $subkey) -Name 'NodeSlot' $subkey = $property.Name if ($hexString -eq $HomeFolderGuid) { $hexString = ($property.Value | ForEach-Object { $_.ToString('X2') }) -join '' if ($property.TypeNameOfValue -eq 'System.Byte[]') { foreach ($property in $properties.PSObject.Properties) { $properties = Get-ItemProperty -Path $bagMRURoot $HomeFolderGuid = '14001F400E3174F8B7B6DC47BC84B9E6B38F59030000' # Define the target GUID tail for MSGraphHome $bagRoot = $ShellRegRoot + '\Bags' $bagMRURoot = $ShellRegRoot + '\BagMRU' $ShellRegRoot = 'HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell' # Define the root registry path $isBroken = 0 154100x800000000000000011570Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:38.274{8223a6b9-15d2-6902-5c02-000000002b00}11052C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.26100.3323 (WinBuild.160101.0800)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEpowershell.exe -ExecutionPolicy Restricted -Command 11241100x800000000000000011571Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:39.378{8223a6b9-15d2-6902-5c02-000000002b00}11052C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SystemTemp\__PSScriptPolicyTest_tvzqydxm.euy.ps12025-10-29 13:25:39.378NT AUTHORITY\SYSTEM 11241100x800000000000000011572Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:39.904{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\liblmstudio\cpu\lmstudiocore.dll2025-10-29 13:25:39.904soc101win11\Administrator 11241100x800000000000000011573Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:39.918{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\liblmstudio\vulkan\lmstudiocore.dll2025-10-29 13:25:39.918soc101win11\Administrator 11241100x800000000000000011574Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:39.922{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\liblmstudio\vulkan\vulkan-1.dll2025-10-29 13:25:39.922soc101win11\Administrator 11241100x800000000000000011575Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:39.971{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\lib\libvips-42.dll2025-10-29 13:25:39.971soc101win11\Administrator 11241100x800000000000000011576Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:40.056{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\lib\libvips-cpp.dll2025-10-29 13:25:40.053soc101win11\Administrator 11241100x800000000000000011577Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:40.327{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\main\native_modules\node-gyp-bin\node-gyp.cmd2025-10-29 13:25:40.327soc101win11\Administrator 11241100x800000000000000011578Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:40.341{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\main\native_modules\node-gyp-bin1\node-gyp.cmd2025-10-29 13:25:40.341soc101win11\Administrator 11241100x800000000000000011579Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:42.542{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\lm-studio-updater\installer.exe2025-10-29 13:25:42.542soc101win11\Administrator 11241100x800000000000000011580Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:44.093{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\Uninstall LM Studio.exe2025-10-29 13:25:44.093soc101win11\Administrator 254200x800000000000000011581Microsoft-Windows-Sysmon/Operationalsoc101win11T10992025-10-29 13:25:44.097{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Local\Programs\LM Studio\Uninstall LM Studio.exe2025-10-18 17:42:32.0002025-10-29 13:25:44.093soc101win11\Administrator 13241300x800000000000000011582Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:25:44.101{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\Uninstall\c6dbe996-22a9-5998-b542-7abe33da3b83\PublisherLM Studiosoc101win11\Administrator 11241100x800000000000000011583Microsoft-Windows-Sysmon/Operationalsoc101win11T10232025-10-29 13:25:44.244{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LM Studio.lnk2025-10-29 13:25:44.244soc101win11\Administrator 11241100x800000000000000011584Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:25:44.248{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\ADMINI~1\AppData\Local\Temp\nsa93B9.tmp\WinShell.dll2025-10-29 13:25:44.248soc101win11\Administrator 154100x800000000000000011585Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:44.316{8223a6b9-15d8-6902-5f02-000000002b00}2028C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 11241100x800000000000000011586Microsoft-Windows-Sysmon/Operationalsoc101win11T10232025-10-29 13:25:44.334{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LM Studio.lnk2025-10-29 13:25:44.244soc101win11\Administrator 154100x800000000000000011587Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:44.702{8223a6b9-15d8-6902-6002-000000002b00}7276C:\Windows\servicing\TrustedInstaller.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Modules InstallerMicrosoft® Windows® Operating SystemMicrosoft CorporationTrustedInstaller.exeC:\WINDOWS\servicing\TrustedInstaller.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=23CF29D35F32448C19398B91E3C31186,SHA256=C037F1D455B27EF75391EECE7F25711CF3055006FA29C5D872DB4D54FEF0ADE8,IMPHASH=5E159CE7599ACD6CA7EC3122186D5DBC{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x800000000000000011588Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:44.761{8223a6b9-15d8-6902-6102-000000002b00}3172C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.4933_none_a4edf32577775419\TiWorker.exe10.0.26100.4933 (WinBuild.160101.0800)Windows Modules Installer WorkerMicrosoft® Windows® Operating SystemMicrosoft CorporationTiWorker.exeC:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.4933_none_a4edf32577775419\TiWorker.exe -EmbeddingC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=749679E003C18036BF998EB9BCE36A63,SHA256=3F42DBAF2BD7AD92577AFB6D47A8F3DC32DCB6A8E52BA7738FAEB31ED197ACDC,IMPHASH=0B85588480DF97BD963732E20722340E{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x800000000000000011589Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:46.765{8223a6b9-15da-6902-6202-000000002b00}7640C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.26100.3323 (WinBuild.160101.0800)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEpowershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=BD542C1197F3B5217B5C5B5C4A25BD0C,SHA256=75F490D70F821AFBBBB28D8AE45FA712C0EF39F73832AF5FF0DF284BEB22A9FC,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77{8223a6b9-15c8-6902-5b02-000000002b00}6292C:\Windows\System32\CompatTelRunner.exeC:\WINDOWS\system32\compattelrunner.exe -cv:CFtwuJIl6U2RpFVm.0.6 -wce:0000000000000228 -m:appraiser.dll -f:DoScheduledTelemetryRun NT AUTHORITY\SYSTEM 11241100x800000000000000011590Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:46.955{8223a6b9-15da-6902-6202-000000002b00}7640C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SystemTemp\__PSScriptPolicyTest_bk4hncwd.4ao.ps12025-10-29 13:25:46.955NT AUTHORITY\SYSTEM 154100x800000000000000011591Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:47.919{8223a6b9-15db-6902-6402-000000002b00}10052C:\Windows\System32\dllhost.exe10.0.26100.1150 (WinBuild.160101.0800)COM SurrogateMicrosoft® Windows® Operating SystemMicrosoft Corporationdllhost.exe"C:\WINDOWS\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA}C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=7450570BA423A8E9864D498D3241FFD4,SHA256=50C9C2EDEA6C51F1AAD2DD80A59F4EDB32637F51714F8472D216E5B9BDACDABF,IMPHASH=FBDAC0471446783AD621D3CAB6033559{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=BD542C1197F3B5217B5C5B5C4A25BD0C,SHA256=75F490D70F821AFBBBB28D8AE45FA712C0EF39F73832AF5FF0DF284BEB22A9FC,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77{8223a6b9-15c8-6902-5b02-000000002b00}6292C:\Windows\System32\CompatTelRunner.exeC:\WINDOWS\system32\compattelrunner.exe -cv:CFtwuJIl6U2RpFVm.0.6 -wce:0000000000000228 -m:appraiser.dll -f:DoScheduledTelemetryRun NT AUTHORITY\SYSTEM Write-Host 'Final result:',$isBroken } } } break $isBroken = if ((Get-ItemPropertyValue -Path ($bagRoot + '\' + $nodeSlot + '\Shell\*') -Name 'GroupView') -eq 0) { 1 } else { 0 } $nodeSlot = Get-ItemPropertyValue -Path ($bagMRURoot + '\' + $subkey) -Name 'NodeSlot' $subkey = $property.Name if ($hexString -eq $HomeFolderGuid) { $hexString = ($property.Value | ForEach-Object { $_.ToString('X2') }) -join '' if ($property.TypeNameOfValue -eq 'System.Byte[]') { foreach ($property in $properties.PSObject.Properties) { $properties = Get-ItemProperty -Path $bagMRURoot $HomeFolderGuid = '14001F400E3174F8B7B6DC47BC84B9E6B38F59030000' # Define the target GUID tail for MSGraphHome $bagRoot = $ShellRegRoot + '\Bags' $bagMRURoot = $ShellRegRoot + '\BagMRU' $ShellRegRoot = 'HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell' # Define the root registry path $isBroken = 0 154100x800000000000000011592Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:49.290{8223a6b9-15dd-6902-6502-000000002b00}8820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.26100.3323 (WinBuild.160101.0800)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEpowershell.exe -ExecutionPolicy Restricted -Command 11241100x800000000000000011593Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:49.492{8223a6b9-15dd-6902-6502-000000002b00}8820C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SystemTemp\__PSScriptPolicyTest_kutwnlsf.i4u.ps12025-10-29 13:25:49.492NT AUTHORITY\SYSTEM 154100x800000000000000011594Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:50.634{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-1327-6902-af00-000000002b00}7368C:\Windows\explorer.exeC:\WINDOWS\Explorer.EXEsoc101win11\Administrator 13241300x800000000000000011595Microsoft-Windows-Sysmon/Operationalsoc101win11InvDBSetValue2025-10-29 13:25:51.265{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeBinary DataNT AUTHORITY\SYSTEM 154100x800000000000000011596Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:52.591{8223a6b9-15e0-6902-6802-000000002b00}3844C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Administrator\AppData\Roaming\LM Studio" /prefetch:4 --no-rate-limit --no-upload-gzip --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator\AppData\Roaming\LM Studio\Crashpad" "--annotation=_productName=LM Studio" --annotation=_version=0.3.30+2 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.2.0 --initial-client-data=0x4c4,0x4c8,0x4cc,0x4c0,0x4d0,0x7ff6780dbb44,0x7ff6780dbb50,0x7ff6780dbb60C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 13241300x800000000000000011597Microsoft-Windows-Sysmon/Operationalsoc101win11T1042SetValue2025-10-29 13:25:53.365{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500_Classes\lmstudio\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" "%%1"soc101win11\Administrator 154100x800000000000000011598Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:53.484{8223a6b9-15e1-6902-6902-000000002b00}6920C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=gpu-process --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1LowMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 154100x800000000000000011599Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:53.494{8223a6b9-15e1-6902-6a02-000000002b00}10756C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:11C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 11241100x800000000000000011600Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:53.513{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\.internal\utils\esbuild.exe2025-10-29 13:25:53.513soc101win11\Administrator 11241100x800000000000000011601Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:53.533{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\.internal\utils\node.exe2025-10-29 13:25:53.533soc101win11\Administrator 11241100x800000000000000011602Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:53.563{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\.internal\utils\deno.exe2025-10-29 13:25:53.563soc101win11\Administrator 154100x800000000000000011603Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:53.632{8223a6b9-15e1-6902-6b02-000000002b00}2976C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:14C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 534500x800000000000000011604Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:53.683{8223a6b9-157b-6902-1002-000000002b00}2140C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exesoc101win11\Administrator 13241300x800000000000000011605Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:25:53.929{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm studio.exe|c460d8612d6d64a5\LowerCaseLongPathc:\users\administrator\appdata\local\programs\lm studio\lm studio.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011606Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:25:53.929{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm studio.exe|c460d8612d6d64a5\Publisherlm studioNT AUTHORITY\SYSTEM 13241300x800000000000000011607Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:25:53.929{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm studio.exe|c460d8612d6d64a5\LinkDate06/30/2025 07:06:07NT AUTHORITY\SYSTEM 13241300x800000000000000011608Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:25:53.929{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm studio.exe|c460d8612d6d64a5\BinProductVersion0.3.30.0NT AUTHORITY\SYSTEM 154100x800000000000000011609Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:54.086{8223a6b9-15e2-6902-6c02-000000002b00}8508C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.26100.3323 (WinBuild.160101.0800)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEpowershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=BD542C1197F3B5217B5C5B5C4A25BD0C,SHA256=75F490D70F821AFBBBB28D8AE45FA712C0EF39F73832AF5FF0DF284BEB22A9FC,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77{8223a6b9-15c8-6902-5b02-000000002b00}6292C:\Windows\System32\CompatTelRunner.exeC:\WINDOWS\system32\compattelrunner.exe -cv:CFtwuJIl6U2RpFVm.0.6 -wce:0000000000000228 -m:appraiser.dll -f:DoScheduledTelemetryRun NT AUTHORITY\SYSTEM 11241100x800000000000000011610Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:54.312{8223a6b9-15e2-6902-6c02-000000002b00}8508C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SystemTemp\__PSScriptPolicyTest_knvwp3rp.1xq.ps12025-10-29 13:25:54.312NT AUTHORITY\SYSTEM 11241100x800000000000000011611Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:25:54.446{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\bin\lms.exe2025-10-29 13:25:54.446soc101win11\Administrator 154100x800000000000000011612Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:54.498{8223a6b9-15e2-6902-6e02-000000002b00}10076C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1596 /prefetch:14C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 11241100x800000000000000011613Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:55.158{8223a6b9-15e0-6902-6802-000000002b00}3844C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\AppData\Roaming\LM Studio\Crashpad\reports\d3b90d3b-59af-4c36-be8a-f4a61ee52961.dmp2025-10-29 13:25:55.158soc101win11\Administrator 534500x800000000000000011614Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:55.334{8223a6b9-15e2-6902-6e02-000000002b00}10076C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 154100x800000000000000011615Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:55.354{8223a6b9-15e3-6902-6f02-000000002b00}1928C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:14C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator "C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=BD542C1197F3B5217B5C5B5C4A25BD0C,SHA256=75F490D70F821AFBBBB28D8AE45FA712C0EF39F73832AF5FF0DF284BEB22A9FC,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator } [Console]::WriteLine($gpu.Name) foreach ($gpu in $gpuInfo) { $gpuInfo = Get-WmiObject -Class Win32_VideoController | Select-Object -Property Name 154100x800000000000000011616Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:55.522{8223a6b9-15e3-6902-7002-000000002b00}8352C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.26100.3323 (WinBuild.160101.0800)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command " 11241100x800000000000000011617Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:55.812{8223a6b9-15e3-6902-7002-000000002b00}8352C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_j00v5u1h.y4z.ps12025-10-29 13:25:55.812soc101win11\Administrator 13241300x800000000000000011618Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:25:56.713{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm-studio-0.3.30|11238f399652b123\LowerCaseLongPathc:\users\administrator\downloads\lm-studio-0.3.30-2-x64.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011619Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:25:56.713{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm-studio-0.3.30|11238f399652b123\Publisherlm studioNT AUTHORITY\SYSTEM 13241300x800000000000000011620Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:25:56.713{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm-studio-0.3.30|11238f399652b123\LinkDate12/15/2018 22:26:14NT AUTHORITY\SYSTEM 13241300x800000000000000011621Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:25:56.713{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\lm-studio-0.3.30|11238f399652b123\BinProductVersion0.3.30.0NT AUTHORITY\SYSTEM 13241300x800000000000000011622Microsoft-Windows-Sysmon/Operationalsoc101win11InvDBSetValue2025-10-29 13:25:56.717{8223a6b9-1371-6902-1601-000000002b00}11820C:\WINDOWS\system32\svchost.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Administrator\Downloads\LM-Studio-0.3.30-2-x64.exeBinary DataNT AUTHORITY\SYSTEM 154100x800000000000000011623Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:57.604{8223a6b9-15e5-6902-7202-000000002b00}8356C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:14C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 154100x800000000000000011624Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:58.789{8223a6b9-15e6-6902-7302-000000002b00}4624C:\Windows\System32\directxdatabaseupdater.exe10.0.26100.3624 (WinBuild.160101.0800)DirectX Database UpdaterMicrosoft® Windows® Operating SystemMicrosoft CorporationDirectXDatabaseUpdater.exeC:\WINDOWS\system32\directxdatabaseupdater.exe -DatabaseComplete {E6F67F2D-D318-46F9-9FB5-C3168327A3EF}C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=D2AAAEB94EA9E68B39410D240334F242,SHA256=49A3186F3EC106E8D1281DE9FC189CE3E606418371A8881D4876AD2A748FF6D5,IMPHASH=74B611F908F64357720ABBF5DAF48BF3{8223a6b9-132e-6902-c800-000000002b00}9780C:\Windows\System32\svchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITSNT AUTHORITY\SYSTEM 154100x800000000000000011625Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:25:59.238{8223a6b9-15e7-6902-7402-000000002b00}3924C:\Windows\System32\Dism\DismHost.exe10.0.26100.1150 (WinBuild.160101.0800)Dism Host Servicing ProcessMicrosoft® Windows® Operating SystemMicrosoft CorporationDismHost.exeC:\Windows\System32\Dism\dismhost.exe {121EBB13-5C26-4B45-8211-AEA0D084DE15}C:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=A5CA984A40E37049FDF649BDCBFA5C88,SHA256=D8EADC9DB05FE0A9C06774DB36C7765E7113F17D8464AD0F3EBAFA5B803B3230,IMPHASH=9DDBEC2516241A81664067A928EDBA2E{8223a6b9-15e6-6902-7302-000000002b00}4624C:\Windows\System32\directxdatabaseupdater.exeC:\WINDOWS\system32\directxdatabaseupdater.exe -DatabaseComplete {E6F67F2D-D318-46F9-9FB5-C3168327A3EF}NT AUTHORITY\SYSTEM 154100x800000000000000011626Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:00.095{8223a6b9-15e8-6902-7502-000000002b00}10044C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=renderer --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --app-user-model-id="electron.app.LM Studio" --app-path="C:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app" --no-sandbox --no-zygote --node-integration-in-worker --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1761743627040775 --launch-time-ticks=733047983 --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 22542200x800000000000000011627Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:00.047{8223a6b9-15de-6902-6702-000000002b00}10092versions-prod.lmstudio.ai0::ffff:104.26.7.153;::ffff:172.67.69.92;::ffff:104.26.6.153;C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 154100x800000000000000011628Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:01.036{8223a6b9-15e9-6902-7602-000000002b00}5688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.26100.3323 (WinBuild.160101.0800)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c "[Environment]::GetEnvironmentVariable('PATH', 'User')"C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=BD542C1197F3B5217B5C5B5C4A25BD0C,SHA256=75F490D70F821AFBBBB28D8AE45FA712C0EF39F73832AF5FF0DF284BEB22A9FC,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 11241100x800000000000000011629Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:01.395{8223a6b9-15e9-6902-7602-000000002b00}5688C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_vcqudxcx.x5o.ps12025-10-29 13:26:01.395soc101win11\Administrator 354300x800000000000000011630Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:26:00.159{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50101-false104.26.7.153-443https 22542200x800000000000000011631Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:00.700{8223a6b9-15e1-6902-6a02-000000002b00}10756wpad1460-C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator [Environment]::SetEnvironmentVariable('PATH', $path, 'User');"C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=BD542C1197F3B5217B5C5B5C4A25BD0C,SHA256=75F490D70F821AFBBBB28D8AE45FA712C0EF39F73832AF5FF0DF284BEB22A9FC,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator $path += \";C:\Users\Administrator\.lmstudio\bin\"; 154100x800000000000000011632Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:02.689{8223a6b9-15ea-6902-7802-000000002b00}1136C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.26100.3323 (WinBuild.160101.0800)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c "$path = [Environment]::GetEnvironmentVariable('PATH', 'User'); 22542200x800000000000000011633Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:01.052{8223a6b9-15de-6902-6702-000000002b00}10092extensions.lmstudio.ai0::ffff:104.26.6.153;::ffff:104.26.7.153;::ffff:172.67.69.92;C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 11241100x800000000000000011634Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:02.937{8223a6b9-15ea-6902-7802-000000002b00}1136C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_y2ypbhzd.ylx.ps12025-10-29 13:26:02.936soc101win11\Administrator 22542200x800000000000000011635Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:01.104{8223a6b9-15de-6902-6702-000000002b00}10092models.lmstudio.ai0::ffff:172.67.69.92;::ffff:104.26.7.153;::ffff:104.26.6.153;C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 154100x800000000000000011636Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:04.609{8223a6b9-15ec-6902-7a02-000000002b00}11924C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe1450.2506.28022.0MoUSO Core Worker ProcessMicrosoft® Windows® Operating SystemMicrosoft CorporationMoUSOCoreWorker.exe"C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespacesC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=E048EE9A14933FFA4A9C9FC7A8A7F83B,SHA256=B4A080E7ABAC28ADCBB172B53060508457C9CEC25BC339F3DFA0A031CD881737,IMPHASH=D3DBFEDBF38C961BD70D128454E64766{8223a6b9-1393-6902-3901-000000002b00}10328C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UsoSvcNT AUTHORITY\SYSTEM 154100x800000000000000011637Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:11.200{8223a6b9-15f3-6902-7e02-000000002b00}5864C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe3.11.9PythonPythonPython Software Foundationpython.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe -I C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\postinstall.pyC:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=B415B7AE268C0945629ABE36C166BC22,SHA256=66BC08D38E5267BD6BEB03BC8A1F876C0571111492B64E160B0D7A84319D46F3,IMPHASH=0A1C54D1A59D88BDB6AA412E07FF0619{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 13241300x800000000000000011638Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:26:11.877{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\python.exe|3e481b98eb59d781\LowerCaseLongPathc:\users\administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011639Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:26:11.877{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\python.exe|3e481b98eb59d781\Publisherpython software foundationNT AUTHORITY\SYSTEM 13241300x800000000000000011640Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:26:11.877{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\python.exe|3e481b98eb59d781\LinkDate08/14/2024 04:19:59NT AUTHORITY\SYSTEM 13241300x800000000000000011641Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:26:11.877{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\python.exe|3e481b98eb59d781\BinProductVersion3.11.9150.1013NT AUTHORITY\SYSTEM 354300x800000000000000011642Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:26:11.101{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50105-false172.67.69.92-443https 354300x800000000000000011643Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:26:11.103{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50103-false104.26.6.153-443https 354300x800000000000000011644Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:26:11.103{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50104-false104.26.6.153-443https 354300x800000000000000011645Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:26:11.336{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50106-false104.26.7.153-443https 22542200x800000000000000011646Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:11.130{8223a6b9-15de-6902-6702-000000002b00}10092search.lmstudio.ai0::ffff:104.26.7.153;::ffff:172.67.69.92;::ffff:104.26.6.153;C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 354300x800000000000000011647Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:26:11.743{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50107-false104.26.6.153-443https 354300x800000000000000011648Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:26:12.387{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50108-false104.26.6.153-443https 354300x800000000000000011649Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:26:12.387{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50110-false104.26.6.153-443https 354300x800000000000000011650Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:26:12.387{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50109-false104.26.6.153-443https 22542200x800000000000000011651Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:11.697{8223a6b9-15de-6902-6702-000000002b00}10092lmstudio.ai0::ffff:104.26.6.153;::ffff:172.67.69.92;::ffff:104.26.7.153;C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 22542200x800000000000000011652Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:12.351{8223a6b9-15de-6902-6702-000000002b00}10092extensions.lmstudio.ai0::ffff:104.26.6.153;::ffff:172.67.69.92;::ffff:104.26.7.153;C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 534500x800000000000000011653Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:16.847{8223a6b9-15f3-6902-7e02-000000002b00}5864C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exesoc101win11\Administrator 154100x800000000000000011654Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:16.870{8223a6b9-15f8-6902-8402-000000002b00}3716C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe3.11.9PythonPythonPython Software Foundationpython.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe -I C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\postinstall.pyC:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=B415B7AE268C0945629ABE36C166BC22,SHA256=66BC08D38E5267BD6BEB03BC8A1F876C0571111492B64E160B0D7A84319D46F3,IMPHASH=0A1C54D1A59D88BDB6AA412E07FF0619{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 11241100x800000000000000011655Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:26:17.114{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-748333135600\Scripts\python.exe2025-10-29 13:26:17.114soc101win11\Administrator 11241100x800000000000000011656Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:26:17.127{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-748333135600\Scripts\pythonw.exe2025-10-29 13:26:17.126soc101win11\Administrator 11241100x800000000000000011657Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:17.471{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\DLLs\libcrypto-3-x64.dll2025-10-29 13:26:17.471soc101win11\Administrator 11241100x800000000000000011658Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:17.548{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\DLLs\libffi-8.dll2025-10-29 13:26:17.547soc101win11\Administrator 11241100x800000000000000011659Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:17.554{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\DLLs\libssl-3-x64.dll2025-10-29 13:26:17.553soc101win11\Administrator 11241100x800000000000000011660Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:17.602{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\DLLs\sqlite3.dll2025-10-29 13:26:17.602soc101win11\Administrator 11241100x800000000000000011661Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:17.623{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\DLLs\tcl86t.dll2025-10-29 13:26:17.622soc101win11\Administrator 11241100x800000000000000011662Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:17.651{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\DLLs\tk86t.dll2025-10-29 13:26:17.650soc101win11\Administrator 11241100x800000000000000011663Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:18.793{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\Lib\ctypes\macholib\fetch_macholib.bat2025-10-29 13:26:18.792soc101win11\Administrator 11241100x800000000000000011664Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:20.717{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\Lib\idlelib\idle.bat2025-10-29 13:26:20.717soc101win11\Administrator 11241100x800000000000000011665Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:22.962{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\Lib\venv\scripts\common\Activate.ps12025-10-29 13:26:22.961soc101win11\Administrator 11241100x800000000000000011666Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:22.965{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\Lib\venv\scripts\nt\activate.bat2025-10-29 13:26:22.965soc101win11\Administrator 11241100x800000000000000011667Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:22.968{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\Lib\venv\scripts\nt\deactivate.bat2025-10-29 13:26:22.968soc101win11\Administrator 11241100x800000000000000011668Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:26:22.969{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\Lib\venv\scripts\nt\python.exe2025-10-29 13:26:22.969soc101win11\Administrator 11241100x800000000000000011669Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:26:22.982{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\Lib\venv\scripts\nt\pythonw.exe2025-10-29 13:26:22.982soc101win11\Administrator 11241100x800000000000000011670Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:26:24.245{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\python.exe2025-10-29 13:26:24.244soc101win11\Administrator 11241100x800000000000000011671Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:24.251{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\python3.dll2025-10-29 13:26:24.251soc101win11\Administrator 11241100x800000000000000011672Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:24.258{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\python311.dll2025-10-29 13:26:24.258soc101win11\Administrator 11241100x800000000000000011673Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:26:24.305{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\pythonw.exe2025-10-29 13:26:24.305soc101win11\Administrator 11241100x800000000000000011674Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:24.325{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\tcl\dde1.4\tcldde14.dll2025-10-29 13:26:24.325soc101win11\Administrator 11241100x800000000000000011675Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:24.352{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\tcl\reg1.3\tclreg13.dll2025-10-29 13:26:24.351soc101win11\Administrator 11241100x800000000000000011676Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:27.395{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\tcl\tix8.4.3\tix84.dll2025-10-29 13:26:27.394soc101win11\Administrator 11241100x800000000000000011677Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:28.057{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\vcruntime140.dll2025-10-29 13:26:28.056soc101win11\Administrator 11241100x800000000000000011678Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:28.062{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\vcruntime140_1.dll2025-10-29 13:26:28.062soc101win11\Administrator 534500x800000000000000011679Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:28.443{8223a6b9-15f8-6902-8402-000000002b00}3716C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exesoc101win11\Administrator 154100x800000000000000011680Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:28.597{8223a6b9-1604-6902-8702-000000002b00}8624C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 154100x800000000000000011681Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:28.707{8223a6b9-1604-6902-8802-000000002b00}3496C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\python.exe3.11.9PythonPythonPython Software Foundationpython.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\python.exe -I -c "import bisect"C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=65DBD77AF4AC01F89BC8FE4F69927D6E,SHA256=5CB1B448FAB5C0B83F89C8FB75C574DB0F270508E29E0BFDECEC1C6E5BEF0BFD,IMPHASH=0A1C54D1A59D88BDB6AA412E07FF0619{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 534500x800000000000000011682Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:28.883{8223a6b9-1604-6902-8802-000000002b00}3496C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\.tmp-750154688100\python.exesoc101win11\Administrator 154100x800000000000000011683Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:29.052{8223a6b9-1605-6902-8b02-000000002b00}4392C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe3.11.9PythonPythonPython Software Foundationpython.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe -I C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\postinstall.pyC:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=B415B7AE268C0945629ABE36C166BC22,SHA256=66BC08D38E5267BD6BEB03BC8A1F876C0571111492B64E160B0D7A84319D46F3,IMPHASH=0A1C54D1A59D88BDB6AA412E07FF0619{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 534500x800000000000000011684Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:29.101{8223a6b9-1604-6902-8702-000000002b00}8624C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 154100x800000000000000011685Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:29.101{8223a6b9-1605-6902-8e02-000000002b00}2588C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 534500x800000000000000011686Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:29.373{8223a6b9-1605-6902-8b02-000000002b00}4392C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exesoc101win11\Administrator 154100x800000000000000011687Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:29.379{8223a6b9-1605-6902-9002-000000002b00}7936C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe3.11.9PythonPythonPython Software Foundationpython.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe -I C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\postinstall.pyC:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=B415B7AE268C0945629ABE36C166BC22,SHA256=66BC08D38E5267BD6BEB03BC8A1F876C0571111492B64E160B0D7A84319D46F3,IMPHASH=0A1C54D1A59D88BDB6AA412E07FF0619{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 11241100x800000000000000011688Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:29.619{8223a6b9-15e0-6902-6802-000000002b00}3844C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\AppData\Roaming\LM Studio\Crashpad\reports\f11264da-d9c9-4a50-aaad-7bddf4b9fa49.dmp2025-10-29 13:26:29.619soc101win11\Administrator 534500x800000000000000011689Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:29.718{8223a6b9-1605-6902-8e02-000000002b00}2588C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 154100x800000000000000011690Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:29.739{8223a6b9-1605-6902-9202-000000002b00}6820C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 534500x800000000000000011691Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:30.130{8223a6b9-1605-6902-9002-000000002b00}7936C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exesoc101win11\Administrator 154100x800000000000000011692Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:30.262{8223a6b9-1606-6902-9502-000000002b00}10996C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\Scripts\python.exe3.11.9PythonPythonPython Software Foundationpy.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\Scripts\python.exe -I -c "import bisect"C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=74A434608B94BD66721A01808B3F3300,SHA256=D61A1F011820011BC0C508D5E8E93380CF54459ED761DE0A9E5D96A2313363F4,IMPHASH=C91715637F89CFF9813ED6D375592AA2{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 154100x800000000000000011693Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:30.333{8223a6b9-1606-6902-9702-000000002b00}2148C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe3.11.9PythonPythonPython Software Foundationpython.exe"C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe" -I -c "import bisect"C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=B415B7AE268C0945629ABE36C166BC22,SHA256=66BC08D38E5267BD6BEB03BC8A1F876C0571111492B64E160B0D7A84319D46F3,IMPHASH=0A1C54D1A59D88BDB6AA412E07FF0619{8223a6b9-1606-6902-9502-000000002b00}10996C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\Scripts\python.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\Scripts\python.exe -I -c "import bisect"soc101win11\Administrator 534500x800000000000000011694Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:30.375{8223a6b9-1606-6902-9702-000000002b00}2148C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exesoc101win11\Administrator 534500x800000000000000011695Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:30.378{8223a6b9-1606-6902-9502-000000002b00}10996C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\Scripts\python.exesoc101win11\Administrator 154100x800000000000000011696Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:30.385{8223a6b9-1606-6902-9802-000000002b00}1184C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe3.11.9PythonPythonPython Software Foundationpython.exeC:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exe -I -c "import bisect"C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=B415B7AE268C0945629ABE36C166BC22,SHA256=66BC08D38E5267BD6BEB03BC8A1F876C0571111492B64E160B0D7A84319D46F3,IMPHASH=0A1C54D1A59D88BDB6AA412E07FF0619{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 534500x800000000000000011697Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:30.447{8223a6b9-1606-6902-9802-000000002b00}1184C:\Users\Administrator\.lmstudio\extensions\backends\vendor\_amphibian\cpython3.11-win-x86@4\python.exesoc101win11\Administrator 13241300x800000000000000011698Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:26:30.574{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\python.exe|aa3a6147ff9508a3\LowerCaseLongPathc:\users\administrator\.lmstudio\extensions\backends\vendor\_amphibian\app-harmony-win-x86@5\scripts\python.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011699Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:26:30.574{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\python.exe|aa3a6147ff9508a3\Publisherpython software foundationNT AUTHORITY\SYSTEM 13241300x800000000000000011700Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:26:30.574{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\python.exe|aa3a6147ff9508a3\LinkDate08/14/2024 04:19:25NT AUTHORITY\SYSTEM 13241300x800000000000000011701Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:26:30.574{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\python.exe|aa3a6147ff9508a3\BinProductVersion3.11.9150.1013NT AUTHORITY\SYSTEM 22542200x800000000000000011702Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:30.288{8223a6b9-15de-6902-6702-000000002b00}10092extensions.lmstudio.ai0::ffff:104.26.7.153;::ffff:172.67.69.92;::ffff:104.26.6.153;C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 354300x800000000000000011703Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:26:30.350{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50111-false104.26.7.153-443https 154100x800000000000000011704Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:32.444{8223a6b9-1608-6902-9b02-000000002b00}10404C:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\node.exe20.18.0Node.js JavaScript RuntimeNode.jsNode.jsnode.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\node.exe" ./.lmstudio/production.jsC:\Users\Administrator\.lmstudio\extensions\plugins\lmstudio\js-code-sandbox\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=5E3ABA1CBDA9F8BB9BBB279F6402E0C6,SHA256=35B7C95A379BEB606F5798ED83081690DF13190077630B234163C6607AA4CC94,IMPHASH=F205B027C46CADF1E2534D1AA11A4093{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 154100x800000000000000011705Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:32.670{8223a6b9-1608-6902-9c02-000000002b00}4300C:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\node.exe20.18.0Node.js JavaScript RuntimeNode.jsNode.jsnode.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\node.exe" ./.lmstudio/production.jsC:\Users\Administrator\.lmstudio\extensions\plugins\lmstudio\rag-v1\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=5E3ABA1CBDA9F8BB9BBB279F6402E0C6,SHA256=35B7C95A379BEB606F5798ED83081690DF13190077630B234163C6607AA4CC94,IMPHASH=F205B027C46CADF1E2534D1AA11A4093{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 11241100x800000000000000011706Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:32.871{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\.tmp-765789934900\ggml-base.dll2025-10-29 13:26:32.871soc101win11\Administrator 11241100x800000000000000011707Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:32.893{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\.tmp-765789934900\ggml-cpu.dll2025-10-29 13:26:32.892soc101win11\Administrator 11241100x800000000000000011708Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:32.903{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\.tmp-765789934900\ggml_llamacpp.dll2025-10-29 13:26:32.903soc101win11\Administrator 11241100x800000000000000011709Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:32.933{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\.tmp-765789934900\llama.dll2025-10-29 13:26:32.933soc101win11\Administrator 11241100x800000000000000011710Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:32.949{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\.tmp-765789934900\llm_engine.dll2025-10-29 13:26:32.949soc101win11\Administrator 11241100x800000000000000011711Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:32.978{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\.tmp-765789934900\lmstudiocore.dll2025-10-29 13:26:32.977soc101win11\Administrator 11241100x800000000000000011712Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:32.993{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\.tmp-765789934900\MSVCP140.dll2025-10-29 13:26:32.993soc101win11\Administrator 11241100x800000000000000011713Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:32.999{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\.tmp-765789934900\mtmd.dll2025-10-29 13:26:32.999soc101win11\Administrator 11241100x800000000000000011714Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:33.006{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\.tmp-765789934900\VCOMP140.dll2025-10-29 13:26:33.005soc101win11\Administrator 11241100x800000000000000011715Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:33.017{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\.tmp-765789934900\VCRUNTIME140.dll2025-10-29 13:26:33.017soc101win11\Administrator 11241100x800000000000000011716Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:26:33.024{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeC:\Users\Administrator\.lmstudio\extensions\backends\.tmp-765789934900\VCRUNTIME140_1.dll2025-10-29 13:26:33.024soc101win11\Administrator 154100x800000000000000011717Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:33.068{8223a6b9-1609-6902-9f02-000000002b00}8760C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 13241300x800000000000000011718Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:26:33.297{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\node.exe|97c6cd93c1bfd9f8\LowerCaseLongPathc:\users\administrator\appdata\local\programs\lm studio\resources\app\.webpack\bin\node.exeNT AUTHORITY\SYSTEM 13241300x800000000000000011719Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:26:33.297{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\node.exe|97c6cd93c1bfd9f8\Publishernode.jsNT AUTHORITY\SYSTEM 13241300x800000000000000011720Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:26:33.297{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\node.exe|97c6cd93c1bfd9f8\LinkDate10/03/2024 06:15:36NT AUTHORITY\SYSTEM 13241300x800000000000000011721Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:26:33.297{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\node.exe|97c6cd93c1bfd9f8\BinProductVersion20.18.0.0NT AUTHORITY\SYSTEM 154100x800000000000000011722Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:33.524{8223a6b9-1609-6902-a002-000000002b00}4512C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 154100x800000000000000011723Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:35.073{8223a6b9-160b-6902-a202-000000002b00}5540C:\Windows\System32\cmd.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /pid 4300 /T /F"C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=90242B3940D153095204CCA04B83DCF3,SHA256=55D95D29D54112FC203D8B2D6335031FD0EF26C56C9459F239760C24DADD3F24,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 154100x800000000000000011724Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:35.085{8223a6b9-160b-6902-a302-000000002b00}5008C:\Windows\System32\cmd.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeC:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /pid 10404 /T /F"C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=90242B3940D153095204CCA04B83DCF3,SHA256=55D95D29D54112FC203D8B2D6335031FD0EF26C56C9459F239760C24DADD3F24,IMPHASH=B0F049C014592B156EB1FA857E99CEB9{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 154100x800000000000000011725Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:35.126{8223a6b9-160b-6902-a602-000000002b00}2068C:\Windows\System32\taskkill.exe10.0.26100.1 (WinBuild.160101.0800)Terminates ProcessesMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskkill.exetaskkill /pid 4300 /T /FC:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CBF904BC6835B56A4BD5AC4141F8D131,SHA256=1249717315FC8F4D2DF17D5DB9DA0444795FDB9FB83DFB1F763C3F39282244F7,IMPHASH=FFE513AF7F8477FE56A2B3C63BE2D148{8223a6b9-160b-6902-a202-000000002b00}5540C:\Windows\System32\cmd.exeC:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /pid 4300 /T /F"soc101win11\Administrator 154100x800000000000000011726Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:35.129{8223a6b9-160b-6902-a702-000000002b00}4916C:\Windows\System32\taskkill.exe10.0.26100.1 (WinBuild.160101.0800)Terminates ProcessesMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskkill.exetaskkill /pid 10404 /T /FC:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CBF904BC6835B56A4BD5AC4141F8D131,SHA256=1249717315FC8F4D2DF17D5DB9DA0444795FDB9FB83DFB1F763C3F39282244F7,IMPHASH=FFE513AF7F8477FE56A2B3C63BE2D148{8223a6b9-160b-6902-a302-000000002b00}5008C:\Windows\System32\cmd.exeC:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /pid 10404 /T /F"soc101win11\Administrator 534500x800000000000000011727Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:35.231{8223a6b9-1608-6902-9c02-000000002b00}4300C:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\node.exesoc101win11\Administrator 534500x800000000000000011728Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:26:35.233{8223a6b9-1608-6902-9b02-000000002b00}10404C:\Users\Administrator\AppData\Local\Programs\LM Studio\resources\app\.webpack\bin\node.exesoc101win11\Administrator 154100x800000000000000011729Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:27:01.188{8223a6b9-1625-6902-a802-000000002b00}3136C:\Windows\System32\UsoClient.exe10.0.26100.3037 (WinBuild.160101.0800)UsoClientMicrosoft® Windows® Operating SystemMicrosoft CorporationUsoClient"C:\WINDOWS\system32\usoclient.exe" StartWorkC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=0AFB6EB9D41AF833D65448734C47A4C2,SHA256=0A4C60CD2FBE6859B6C09F56C7051580F9582F106D1851750264733194B94DB3,IMPHASH=1BC6441172601AD7E84C0082681FF7D2{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 354300x800000000000000011730Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:27:34.469{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50116-false104.26.7.153-443https 22542200x800000000000000011731Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:27:34.439{8223a6b9-15de-6902-6702-000000002b00}10092lmstudio.ai0::ffff:104.26.7.153;::ffff:104.26.6.153;::ffff:172.67.69.92;C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 354300x800000000000000011732Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:27:35.775{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50118-false104.26.6.153-443https 354300x800000000000000011733Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:27:35.775{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50119-false104.26.6.153-443https 354300x800000000000000011734Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:27:35.775{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50117-false104.26.6.153-443https 22542200x800000000000000011735Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:27:35.746{8223a6b9-15de-6902-6702-000000002b00}10092search.lmstudio.ai0::ffff:104.26.6.153;::ffff:172.67.69.92;::ffff:104.26.7.153;C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 154100x800000000000000011736Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:27:53.495{8223a6b9-1659-6902-a902-000000002b00}4668C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe0.3.30LM StudioLM StudioLM Studio-"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5549 --gpu-device-id=1029 --gpu-sub-system-id=67442093 --gpu-revision=0 --gpu-driver-version=9.17.7.4 --user-data-dir="C:\Users\Administrator\AppData\Roaming\LM Studio" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1776,i,3191266903891849080,14785981096155531668,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:10C:\Users\Administrator\AppData\Local\Programs\LM Studio\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=CF2B4038B1118E044418C8A1D92D782A,SHA256=EBD98C1B420975C8D40D8C5C6952160F672CC6351C4761B41C8215F64BE47080,IMPHASH=3687CC090FBF8C913764492C5CD3A58B{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe"C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe" soc101win11\Administrator 534500x800000000000000011737Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:27:53.616{8223a6b9-1659-6902-a902-000000002b00}4668C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 13241300x800000000000000011738Microsoft-Windows-Sysmon/Operationalsoc101win11T1060,RunKeySetValue2025-10-29 13:28:00.456{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.LM StudioC:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exe --run-as-servicesoc101win11\Administrator 22542200x800000000000000011739Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:28:06.750{8223a6b9-15de-6902-6702-000000002b00}10092lmstudio.ai0::ffff:104.26.7.153;::ffff:172.67.69.92;::ffff:104.26.6.153;C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 22542200x800000000000000011740Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:28:07.342{8223a6b9-15de-6902-6702-000000002b00}10092search.lmstudio.ai0::ffff:172.67.69.92;::ffff:104.26.6.153;::ffff:104.26.7.153;C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administrator 354300x800000000000000011741Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:28:06.778{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50121-false104.26.7.153-443https 354300x800000000000000011742Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:28:07.388{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50122-false172.67.69.92-443https 354300x800000000000000011743Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:28:07.388{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50123-false172.67.69.92-443https 354300x800000000000000011744Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:28:07.388{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50124-false172.67.69.92-443https 13241300x800000000000000011745Microsoft-Windows-Sysmon/Operationalsoc101win11T1060,RunKeySetValue2025-10-29 13:28:10.458{8223a6b9-1327-6902-a100-000000002b00}6708C:\WINDOWS\system32\sihost.exeHKU\S-1-5-21-4051859043-1187413090-3677023548-500\Software\Microsoft\Windows\CurrentVersion\RunNotification\StartupTNotielectron.app.LM StudioDWORD (0x00000001)soc101win11\Administrator 354300x800000000000000011746Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:28:18.531{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50126-false104.26.7.153-443https 354300x800000000000000011747Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:28:18.635{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50128-false104.26.7.153-443https 354300x800000000000000011748Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:28:18.635{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50129-false104.26.7.153-443https 354300x800000000000000011749Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:28:18.635{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50127-false104.26.7.153-443https 354300x800000000000000011750Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:28:20.938{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50130-false104.26.7.153-443https 354300x800000000000000011751Microsoft-Windows-Sysmon/Operationalsoc101win11Usermode2025-10-29 13:28:20.938{8223a6b9-15de-6902-6702-000000002b00}10092C:\Users\Administrator\AppData\Local\Programs\LM Studio\LM Studio.exesoc101win11\Administratortcptruefalse172.16.143.133soc101win11.localdomain50131-false104.26.7.153-443https 154100x800000000000000011752Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:29:14.638{8223a6b9-16aa-6902-aa02-000000002b00}5376C:\Windows\System32\UsoClient.exe10.0.26100.3037 (WinBuild.160101.0800)UsoClientMicrosoft® Windows® Operating SystemMicrosoft CorporationUsoClient"C:\WINDOWS\system32\usoclient.exe" StartWorkC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=0AFB6EB9D41AF833D65448734C47A4C2,SHA256=0A4C60CD2FBE6859B6C09F56C7051580F9582F106D1851750264733194B94DB3,IMPHASH=1BC6441172601AD7E84C0082681FF7D2{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x800000000000000011753Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:29:14.679{8223a6b9-16aa-6902-ab02-000000002b00}11008C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe1450.2506.28022.0MoUSO Core Worker ProcessMicrosoft® Windows® Operating SystemMicrosoft CorporationMoUSOCoreWorker.exe"C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespacesC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=E048EE9A14933FFA4A9C9FC7A8A7F83B,SHA256=B4A080E7ABAC28ADCBB172B53060508457C9CEC25BC339F3DFA0A031CD881737,IMPHASH=D3DBFEDBF38C961BD70D128454E64766{8223a6b9-1393-6902-3901-000000002b00}10328C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UsoSvcNT AUTHORITY\SYSTEM 154100x800000000000000011754Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:29:15.236{8223a6b9-16ab-6902-af02-000000002b00}11804C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x800000000000000011755Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:29:15.792{8223a6b9-16ab-6902-b102-000000002b00}10368C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe -RegisterUserDevice -NewAccountC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x800000000000000011756Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:29:16.450{8223a6b9-16ac-6902-b202-000000002b00}4072C:\Windows\servicing\TrustedInstaller.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Modules InstallerMicrosoft® Windows® Operating SystemMicrosoft CorporationTrustedInstaller.exeC:\WINDOWS\servicing\TrustedInstaller.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=23CF29D35F32448C19398B91E3C31186,SHA256=C037F1D455B27EF75391EECE7F25711CF3055006FA29C5D872DB4D54FEF0ADE8,IMPHASH=5E159CE7599ACD6CA7EC3122186D5DBC{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x800000000000000011757Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:29:16.476{8223a6b9-16ac-6902-b302-000000002b00}6948C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.4933_none_a4edf32577775419\TiWorker.exe10.0.26100.4933 (WinBuild.160101.0800)Windows Modules Installer WorkerMicrosoft® Windows® Operating SystemMicrosoft CorporationTiWorker.exeC:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.4933_none_a4edf32577775419\TiWorker.exe -EmbeddingC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=749679E003C18036BF998EB9BCE36A63,SHA256=3F42DBAF2BD7AD92577AFB6D47A8F3DC32DCB6A8E52BA7738FAEB31ED197ACDC,IMPHASH=0B85588480DF97BD963732E20722340E{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 11241100x800000000000000011758Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:00.255{8223a6b9-16aa-6902-ab02-000000002b00}11008C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exeC:\Windows\SystemTemp\{E7296E88-6A24-4EC0-B6CB-0876877773F9}\ssshim.dll2025-10-29 13:30:00.255NT AUTHORITY\SYSTEM 154100x800000000000000011759Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:30:00.465{8223a6b9-16d8-6902-b602-000000002b00}10504C:\Windows\UUS\Packages\Preview\amd64\MoNotificationUx.exe1450.2506.28022.0Notifications host processMicrosoft® Windows® Operating SystemMicrosoft CorporationMoNotificationUx.exeC:\WINDOWS\uus\packages\preview\AMD64\MoNotificationUx.exe /ClearActiveNotifications /CV x2sHkZhQTUqT3y32.1.0.0C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=D97428A8D4622A2B55C29AAF093A4587,SHA256=84913C18E04A4BFD84A0EC98FE5D636607C5A0EC9C320602FC53B45BB06E3C1B,IMPHASH=B582311B9D89BE4D0BBCB08118245AB0{8223a6b9-16aa-6902-ab02-000000002b00}11008C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe"C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespacesNT AUTHORITY\SYSTEM 11241100x800000000000000011760Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:00.586{8223a6b9-16aa-6902-ab02-000000002b00}11008C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exeC:\Windows\SystemTemp\{739AB9B2-D5BE-4188-B2B1-BA6A919ABE45}\ssshim.dll2025-10-29 13:30:00.586NT AUTHORITY\SYSTEM 154100x800000000000000011761Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:30:02.011{8223a6b9-16da-6902-b802-000000002b00}1944C:\Windows\System32\svchost.exe10.0.26100.4343 (WinBuild.160101.0800)Host Process for Windows ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=5A33432E6DB9DC2BE4C52E7768F0319C,SHA256=D4DF279E1201638455A81F9AE79939945589A4A01D56F610E32490686D066319,IMPHASH=DE43BD45CC98C143357416C7519ECCFD{8223a6b9-1314-6902-0b00-000000002b00}832C:\Windows\System32\services.exeC:\WINDOWS\system32\services.exeNT AUTHORITY\SYSTEM 154100x800000000000000011762Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:30:18.420{8223a6b9-16ea-6902-ba02-000000002b00}9788C:\Windows\UUS\Packages\Preview\amd64\MoNotificationUx.exe1450.2506.28022.0Notifications host processMicrosoft® Windows® Operating SystemMicrosoft CorporationMoNotificationUx.exeC:\WINDOWS\uus\packages\preview\AMD64\MoNotificationUx.exe /ClearActiveNotifications /CV x2sHkZhQTUqT3y32.1.0.0C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=D97428A8D4622A2B55C29AAF093A4587,SHA256=84913C18E04A4BFD84A0EC98FE5D636607C5A0EC9C320602FC53B45BB06E3C1B,IMPHASH=B582311B9D89BE4D0BBCB08118245AB0{8223a6b9-16aa-6902-ab02-000000002b00}11008C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe"C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespacesNT AUTHORITY\SYSTEM 154100x800000000000000011763Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:30:18.781{8223a6b9-16ea-6902-bb02-000000002b00}2044C:\Windows\UUS\Packages\Preview\amd64\MoNotificationUx.exe1450.2506.28022.0Notifications host processMicrosoft® Windows® Operating SystemMicrosoft CorporationMoNotificationUx.exeC:\WINDOWS\uus\packages\preview\AMD64\MoNotificationUx.exe /ClearActiveNotifications /CV x2sHkZhQTUqT3y32.1.0.0C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=D97428A8D4622A2B55C29AAF093A4587,SHA256=84913C18E04A4BFD84A0EC98FE5D636607C5A0EC9C320602FC53B45BB06E3C1B,IMPHASH=B582311B9D89BE4D0BBCB08118245AB0{8223a6b9-16aa-6902-ab02-000000002b00}11008C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe"C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespacesNT AUTHORITY\SYSTEM 11241100x800000000000000011764Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:18.990{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{B0FD0C4E-5BB5-47BC-AC92-DBAA829A2969}\ssshim.dll2025-10-29 13:30:18.990NT AUTHORITY\SYSTEM 13241300x800000000000000011765Microsoft-Windows-Sysmon/Operationalsoc101win11Tamper-WinlogonSetValue2025-10-29 13:30:21.471{8223a6b9-16ac-6902-b202-000000002b00}4072C:\WINDOWS\servicing\TrustedInstaller.exeHKLM\System\CurrentControlSet\Control\Winlogon\Notifications\Components\TrustedInstaller\EventsCreateSessionNT AUTHORITY\SYSTEM 11241100x800000000000000011766Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:21.634{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{F2C52E0E-39EA-4CE2-AD20-65134E3CEF52}\ssshim.dll2025-10-29 13:30:21.634NT AUTHORITY\SYSTEM 13241300x800000000000000011767Microsoft-Windows-Sysmon/Operationalsoc101win11Tamper-WinlogonSetValue2025-10-29 13:30:22.373{8223a6b9-16ac-6902-b202-000000002b00}4072C:\WINDOWS\servicing\TrustedInstaller.exeHKLM\System\CurrentControlSet\Control\Winlogon\Notifications\Components\TrustedInstaller\Events(Empty)NT AUTHORITY\SYSTEM 11241100x800000000000000011768Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:33.629{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{88CEB0A2-F34C-4D7B-8746-40297DB1CE8F}\ssshim.dll2025-10-29 13:30:33.629NT AUTHORITY\SYSTEM 11241100x800000000000000011769Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:33.980{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\UpdateCompression.dll2025-10-29 13:30:33.980NT AUTHORITY\SYSTEM 11241100x800000000000000011770Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:33.986{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\featurestaging.dll2025-10-29 13:30:33.984NT AUTHORITY\SYSTEM 11241100x800000000000000011771Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:33.988{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\updatedeploy.dll2025-10-29 13:30:33.988NT AUTHORITY\SYSTEM 11241100x800000000000000011772Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:33.994{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\AppxDeviceInventory.dll2025-10-29 13:30:33.994NT AUTHORITY\SYSTEM 11241100x800000000000000011773Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:34.002{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\TurboStack.dll2025-10-29 13:30:34.002NT AUTHORITY\SYSTEM 11241100x800000000000000011774Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:34.019{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\UAOneSettings.dll2025-10-29 13:30:34.019NT AUTHORITY\SYSTEM 11241100x800000000000000011775Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:34.021{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\wcp.dll2025-10-29 13:30:34.021NT AUTHORITY\SYSTEM 11241100x800000000000000011776Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:34.054{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\MsixPackageProvisioner.dll2025-10-29 13:30:34.054NT AUTHORITY\SYSTEM 11241100x800000000000000011777Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:34.060{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\dpx.dll2025-10-29 13:30:34.060NT AUTHORITY\SYSTEM 11241100x800000000000000011778Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:34.072{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\WinREAgent.dll2025-10-29 13:30:34.070NT AUTHORITY\SYSTEM 11241100x800000000000000011779Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:34.080{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\ReserveManager.dll2025-10-29 13:30:34.080NT AUTHORITY\SYSTEM 11241100x800000000000000011780Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:34.084{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\Mitigation.dll2025-10-29 13:30:34.084NT AUTHORITY\SYSTEM 11241100x800000000000000011781Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:34.090{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\UpdateAgent.dll2025-10-29 13:30:34.090NT AUTHORITY\SYSTEM 11241100x800000000000000011782Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:47.406{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{D8935652-D486-441F-9602-75757A8E8833}\ssshim.dll2025-10-29 13:30:47.404NT AUTHORITY\SYSTEM 11241100x800000000000000011783Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:48.382{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{39044C85-A167-40AD-8003-F971023DCFF8}\ssshim.dll2025-10-29 13:30:48.380NT AUTHORITY\SYSTEM 13241300x800000000000000011784Microsoft-Windows-Sysmon/Operationalsoc101win11Tamper-WinlogonSetValue2025-10-29 13:30:50.128{8223a6b9-16ac-6902-b202-000000002b00}4072C:\WINDOWS\servicing\TrustedInstaller.exeHKLM\System\CurrentControlSet\Control\Winlogon\Notifications\Components\TrustedInstaller\EventsCreateSessionNT AUTHORITY\SYSTEM 13241300x800000000000000011785Microsoft-Windows-Sysmon/Operationalsoc101win11Tamper-WinlogonSetValue2025-10-29 13:30:50.884{8223a6b9-16ac-6902-b202-000000002b00}4072C:\WINDOWS\servicing\TrustedInstaller.exeHKLM\System\CurrentControlSet\Control\Winlogon\Notifications\Components\TrustedInstaller\Events(Empty)NT AUTHORITY\SYSTEM 11241100x800000000000000011786Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:51.897{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{E5F2DD94-F017-4A98-BF85-B727BD695976}\ssshim.dll2025-10-29 13:30:51.897NT AUTHORITY\SYSTEM 11241100x800000000000000011787Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.465{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\clretwrc.dll2025-10-29 13:30:53.465NT AUTHORITY\SYSTEM 11241100x800000000000000011788Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.465{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\clrjit.dll2025-10-29 13:30:53.465NT AUTHORITY\SYSTEM 11241100x800000000000000011789Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.467{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\coreclr.dll2025-10-29 13:30:53.465NT AUTHORITY\SYSTEM 11241100x800000000000000011790Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:30:53.467{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\createdump.exe2025-10-29 13:30:53.467NT AUTHORITY\SYSTEM 11241100x800000000000000011791Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.467{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\dbgshim.dll2025-10-29 13:30:53.467NT AUTHORITY\SYSTEM 11241100x800000000000000011792Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.469{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\GetHelp.dll2025-10-29 13:30:53.467NT AUTHORITY\SYSTEM 11241100x800000000000000011793Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:30:53.469{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\GetHelp.exe2025-10-29 13:30:53.469NT AUTHORITY\SYSTEM 11241100x800000000000000011794Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.469{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\GraphQL.Client.Abstractions.dll2025-10-29 13:30:53.469NT AUTHORITY\SYSTEM 11241100x800000000000000011795Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.469{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\GraphQL.Client.Abstractions.Websocket.dll2025-10-29 13:30:53.469NT AUTHORITY\SYSTEM 11241100x800000000000000011796Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.469{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\GraphQL.Client.Serializer.Newtonsoft.dll2025-10-29 13:30:53.469NT AUTHORITY\SYSTEM 11241100x800000000000000011797Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.471{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\GraphQL.Primitives.dll2025-10-29 13:30:53.471NT AUTHORITY\SYSTEM 11241100x800000000000000011798Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.471{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\hostfxr.dll2025-10-29 13:30:53.471NT AUTHORITY\SYSTEM 11241100x800000000000000011799Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.471{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\hostpolicy.dll2025-10-29 13:30:53.471NT AUTHORITY\SYSTEM 11241100x800000000000000011800Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.471{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Markdig.Signed.dll2025-10-29 13:30:53.471NT AUTHORITY\SYSTEM 11241100x800000000000000011801Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.471{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.ApplicationInsights.dll2025-10-29 13:30:53.471NT AUTHORITY\SYSTEM 11241100x800000000000000011802Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.471{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.CodeAnalysis.CSharp.dll2025-10-29 13:30:53.471NT AUTHORITY\SYSTEM 11241100x800000000000000011803Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.473{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.CodeAnalysis.dll2025-10-29 13:30:53.473NT AUTHORITY\SYSTEM 11241100x800000000000000011804Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.473{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.CSharp.dll2025-10-29 13:30:53.473NT AUTHORITY\SYSTEM 11241100x800000000000000011805Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.473{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.Abstractions.dll2025-10-29 13:30:53.473NT AUTHORITY\SYSTEM 11241100x800000000000000011806Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.473{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.Binder.dll2025-10-29 13:30:53.473NT AUTHORITY\SYSTEM 11241100x800000000000000011807Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.473{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.dll2025-10-29 13:30:53.473NT AUTHORITY\SYSTEM 11241100x800000000000000011808Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.475{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.DependencyInjection.Abstractions.dll2025-10-29 13:30:53.473NT AUTHORITY\SYSTEM 11241100x800000000000000011809Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.475{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.DependencyInjection.dll2025-10-29 13:30:53.475NT AUTHORITY\SYSTEM 11241100x800000000000000011810Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.475{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.Abstractions.dll2025-10-29 13:30:53.475NT AUTHORITY\SYSTEM 11241100x800000000000000011811Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.475{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.Configuration.dll2025-10-29 13:30:53.475NT AUTHORITY\SYSTEM 11241100x800000000000000011812Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.475{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.dll2025-10-29 13:30:53.475NT AUTHORITY\SYSTEM 11241100x800000000000000011813Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.475{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.ObjectPool.dll2025-10-29 13:30:53.475NT AUTHORITY\SYSTEM 11241100x800000000000000011814Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.475{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Options.ConfigurationExtensions.dll2025-10-29 13:30:53.475NT AUTHORITY\SYSTEM 11241100x800000000000000011815Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.477{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Options.dll2025-10-29 13:30:53.477NT AUTHORITY\SYSTEM 11241100x800000000000000011816Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.477{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Primitives.dll2025-10-29 13:30:53.477NT AUTHORITY\SYSTEM 11241100x800000000000000011817Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.477{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Graphics.Canvas.Interop.dll2025-10-29 13:30:53.477NT AUTHORITY\SYSTEM 11241100x800000000000000011818Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.477{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Identity.Client.Broker.dll2025-10-29 13:30:53.477NT AUTHORITY\SYSTEM 11241100x800000000000000011819Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.477{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Identity.Client.dll2025-10-29 13:30:53.477NT AUTHORITY\SYSTEM 11241100x800000000000000011820Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.479{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Identity.Client.Extensions.Msal.dll2025-10-29 13:30:53.479NT AUTHORITY\SYSTEM 11241100x800000000000000011821Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.479{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Identity.Client.NativeInterop.dll2025-10-29 13:30:53.479NT AUTHORITY\SYSTEM 11241100x800000000000000011822Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.479{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.IdentityModel.Abstractions.dll2025-10-29 13:30:53.479NT AUTHORITY\SYSTEM 11241100x800000000000000011823Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.479{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.IdentityModel.JsonWebTokens.dll2025-10-29 13:30:53.479NT AUTHORITY\SYSTEM 11241100x800000000000000011824Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.479{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.IdentityModel.Logging.dll2025-10-29 13:30:53.479NT AUTHORITY\SYSTEM 11241100x800000000000000011825Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.481{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.IdentityModel.Tokens.dll2025-10-29 13:30:53.481NT AUTHORITY\SYSTEM 11241100x800000000000000011826Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.481{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.InteractiveExperiences.Projection.dll2025-10-29 13:30:53.481NT AUTHORITY\SYSTEM 11241100x800000000000000011827Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.481{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Management.Infrastructure.CimCmdlets.dll2025-10-29 13:30:53.481NT AUTHORITY\SYSTEM 11241100x800000000000000011828Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.481{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Management.Infrastructure.dll2025-10-29 13:30:53.481NT AUTHORITY\SYSTEM 11241100x800000000000000011829Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.481{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Management.Infrastructure.Native.dll2025-10-29 13:30:53.481NT AUTHORITY\SYSTEM 11241100x800000000000000011830Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.483{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Office.PrivacyGuard.dll2025-10-29 13:30:53.483NT AUTHORITY\SYSTEM 11241100x800000000000000011831Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.483{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Office.Telemetry.EventFlags.dll2025-10-29 13:30:53.483NT AUTHORITY\SYSTEM 11241100x800000000000000011832Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.483{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.OneSettingsClient.Managed.dll2025-10-29 13:30:53.483NT AUTHORITY\SYSTEM 11241100x800000000000000011833Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.483{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.PowerShell.Commands.Diagnostics.dll2025-10-29 13:30:53.483NT AUTHORITY\SYSTEM 11241100x800000000000000011834Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.483{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.PowerShell.Commands.Management.dll2025-10-29 13:30:53.483NT AUTHORITY\SYSTEM 11241100x800000000000000011835Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.485{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.PowerShell.Commands.Utility.dll2025-10-29 13:30:53.483NT AUTHORITY\SYSTEM 11241100x800000000000000011836Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.485{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.PowerShell.ConsoleHost.dll2025-10-29 13:30:53.485NT AUTHORITY\SYSTEM 11241100x800000000000000011837Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.485{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.PowerShell.CoreCLR.Eventing.dll2025-10-29 13:30:53.485NT AUTHORITY\SYSTEM 11241100x800000000000000011838Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.485{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.PowerShell.MarkdownRender.dll2025-10-29 13:30:53.485NT AUTHORITY\SYSTEM 11241100x800000000000000011839Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.485{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.PowerShell.Security.dll2025-10-29 13:30:53.485NT AUTHORITY\SYSTEM 11241100x800000000000000011840Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.485{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Security.Authentication.OAuth.Projection.dll2025-10-29 13:30:53.485NT AUTHORITY\SYSTEM 11241100x800000000000000011841Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.487{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Unified.Telemetry.ContractsAndContextProviders.dll2025-10-29 13:30:53.485NT AUTHORITY\SYSTEM 11241100x800000000000000011842Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.487{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Unified.Telemetry.dll2025-10-29 13:30:53.487NT AUTHORITY\SYSTEM 11241100x800000000000000011843Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.487{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Unified.Telemetry.OpenTelemetrySink.dll2025-10-29 13:30:53.487NT AUTHORITY\SYSTEM 11241100x800000000000000011844Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.487{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.VisualBasic.Core.dll2025-10-29 13:30:53.487NT AUTHORITY\SYSTEM 11241100x800000000000000011845Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.489{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.VisualBasic.dll2025-10-29 13:30:53.487NT AUTHORITY\SYSTEM 11241100x800000000000000011846Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.489{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Web.WebView2.Core.dll2025-10-29 13:30:53.489NT AUTHORITY\SYSTEM 11241100x800000000000000011847Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.489{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Web.WebView2.Core.Projection.dll2025-10-29 13:30:53.489NT AUTHORITY\SYSTEM 11241100x800000000000000011848Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.489{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Win32.Primitives.dll2025-10-29 13:30:53.489NT AUTHORITY\SYSTEM 11241100x800000000000000011849Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.491{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Win32.Registry.AccessControl.dll2025-10-29 13:30:53.491NT AUTHORITY\SYSTEM 11241100x800000000000000011850Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.491{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Win32.Registry.dll2025-10-29 13:30:53.491NT AUTHORITY\SYSTEM 11241100x800000000000000011851Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.493{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Win32.SystemEvents.dll2025-10-29 13:30:53.491NT AUTHORITY\SYSTEM 11241100x800000000000000011852Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.495{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Background.Projection.dll2025-10-29 13:30:53.493NT AUTHORITY\SYSTEM 11241100x800000000000000011853Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.495{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Background.UniversalBGTask.dll2025-10-29 13:30:53.495NT AUTHORITY\SYSTEM 11241100x800000000000000011854Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.495{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.DynamicDependency.Projection.dll2025-10-29 13:30:53.495NT AUTHORITY\SYSTEM 11241100x800000000000000011855Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.495{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Resources.Projection.dll2025-10-29 13:30:53.495NT AUTHORITY\SYSTEM 11241100x800000000000000011856Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.495{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.WindowsAppRuntime.Projection.dll2025-10-29 13:30:53.495NT AUTHORITY\SYSTEM 11241100x800000000000000011857Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.495{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.AppLifecycle.Projection.dll2025-10-29 13:30:53.495NT AUTHORITY\SYSTEM 11241100x800000000000000011858Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.497{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.AppNotifications.Builder.Projection.dll2025-10-29 13:30:53.495NT AUTHORITY\SYSTEM 11241100x800000000000000011859Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.497{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.AppNotifications.Projection.dll2025-10-29 13:30:53.497NT AUTHORITY\SYSTEM 11241100x800000000000000011860Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.497{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.BadgeNotifications.Projection.dll2025-10-29 13:30:53.497NT AUTHORITY\SYSTEM 11241100x800000000000000011861Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.497{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Management.Deployment.Projection.dll2025-10-29 13:30:53.497NT AUTHORITY\SYSTEM 11241100x800000000000000011862Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.497{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Media.Capture.Projection.dll2025-10-29 13:30:53.497NT AUTHORITY\SYSTEM 11241100x800000000000000011863Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.497{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.PushNotifications.Projection.dll2025-10-29 13:30:53.497NT AUTHORITY\SYSTEM 11241100x800000000000000011864Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.499{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.SDK.NET.dll2025-10-29 13:30:53.499NT AUTHORITY\SYSTEM 11241100x800000000000000011865Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.499{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Security.AccessControl.Projection.dll2025-10-29 13:30:53.499NT AUTHORITY\SYSTEM 11241100x800000000000000011866Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.499{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Storage.Projection.dll2025-10-29 13:30:53.499NT AUTHORITY\SYSTEM 11241100x800000000000000011867Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.499{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.System.Power.Projection.dll2025-10-29 13:30:53.499NT AUTHORITY\SYSTEM 11241100x800000000000000011868Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.499{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.System.Projection.dll2025-10-29 13:30:53.499NT AUTHORITY\SYSTEM 11241100x800000000000000011869Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.499{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Widgets.Projection.dll2025-10-29 13:30:53.499NT AUTHORITY\SYSTEM 11241100x800000000000000011870Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.501{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.Bootstrap.dll2025-10-29 13:30:53.499NT AUTHORITY\SYSTEM 11241100x800000000000000011871Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.501{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.Bootstrap.Net.dll2025-10-29 13:30:53.501NT AUTHORITY\SYSTEM 11241100x800000000000000011872Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.501{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.WinUI.dll2025-10-29 13:30:53.501NT AUTHORITY\SYSTEM 11241100x800000000000000011873Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.501{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.WSMan.Management.dll2025-10-29 13:30:53.501NT AUTHORITY\SYSTEM 11241100x800000000000000011874Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.501{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Microsoft.WSMan.Runtime.dll2025-10-29 13:30:53.501NT AUTHORITY\SYSTEM 11241100x800000000000000011875Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.503{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\mscordaccore.dll2025-10-29 13:30:53.503NT AUTHORITY\SYSTEM 11241100x800000000000000011876Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.503{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\mscordaccore_amd64_amd64_6.0.3624.51421.dll2025-10-29 13:30:53.503NT AUTHORITY\SYSTEM 11241100x800000000000000011877Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.503{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\mscordbi.dll2025-10-29 13:30:53.503NT AUTHORITY\SYSTEM 11241100x800000000000000011878Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.503{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\mscorlib.dll2025-10-29 13:30:53.503NT AUTHORITY\SYSTEM 11241100x800000000000000011879Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.503{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\mscorrc.dll2025-10-29 13:30:53.503NT AUTHORITY\SYSTEM 11241100x800000000000000011880Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.503{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Namotion.Reflection.dll2025-10-29 13:30:53.503NT AUTHORITY\SYSTEM 11241100x800000000000000011881Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.503{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\NativeNetworkDiagnosticsWRC.dll2025-10-29 13:30:53.503NT AUTHORITY\SYSTEM 11241100x800000000000000011882Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.505{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\netstandard.dll2025-10-29 13:30:53.505NT AUTHORITY\SYSTEM 11241100x800000000000000011883Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.505{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\Newtonsoft.Json.dll2025-10-29 13:30:53.505NT AUTHORITY\SYSTEM 11241100x800000000000000011884Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.505{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\NJsonSchema.dll2025-10-29 13:30:53.505NT AUTHORITY\SYSTEM 11241100x800000000000000011885Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.505{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\OpenTelemetry.Api.dll2025-10-29 13:30:53.505NT AUTHORITY\SYSTEM 11241100x800000000000000011886Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.505{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\OpenTelemetry.Api.ProviderBuilderExtensions.dll2025-10-29 13:30:53.505NT AUTHORITY\SYSTEM 11241100x800000000000000011887Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.505{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\OpenTelemetry.dll2025-10-29 13:30:53.505NT AUTHORITY\SYSTEM 11241100x800000000000000011888Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.507{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\OpenTelemetry.Exporter.OneCollector.dll2025-10-29 13:30:53.507NT AUTHORITY\SYSTEM 11241100x800000000000000011889Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.507{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.AppContext.dll2025-10-29 13:30:53.507NT AUTHORITY\SYSTEM 11241100x800000000000000011890Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.507{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Buffers.dll2025-10-29 13:30:53.507NT AUTHORITY\SYSTEM 11241100x800000000000000011891Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.507{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.CodeDom.dll2025-10-29 13:30:53.507NT AUTHORITY\SYSTEM 11241100x800000000000000011892Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.507{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Collections.Concurrent.dll2025-10-29 13:30:53.507NT AUTHORITY\SYSTEM 11241100x800000000000000011893Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.509{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Collections.dll2025-10-29 13:30:53.509NT AUTHORITY\SYSTEM 11241100x800000000000000011894Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.509{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Collections.Immutable.dll2025-10-29 13:30:53.509NT AUTHORITY\SYSTEM 11241100x800000000000000011895Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.509{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Collections.NonGeneric.dll2025-10-29 13:30:53.509NT AUTHORITY\SYSTEM 11241100x800000000000000011896Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.509{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Collections.Specialized.dll2025-10-29 13:30:53.509NT AUTHORITY\SYSTEM 11241100x800000000000000011897Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.511{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ComponentModel.Annotations.dll2025-10-29 13:30:53.509NT AUTHORITY\SYSTEM 11241100x800000000000000011898Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.511{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ComponentModel.Composition.dll2025-10-29 13:30:53.511NT AUTHORITY\SYSTEM 11241100x800000000000000011899Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.511{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ComponentModel.Composition.Registration.dll2025-10-29 13:30:53.511NT AUTHORITY\SYSTEM 11241100x800000000000000011900Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.511{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ComponentModel.DataAnnotations.dll2025-10-29 13:30:53.511NT AUTHORITY\SYSTEM 11241100x800000000000000011901Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.511{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ComponentModel.dll2025-10-29 13:30:53.511NT AUTHORITY\SYSTEM 11241100x800000000000000011902Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.511{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ComponentModel.EventBasedAsync.dll2025-10-29 13:30:53.511NT AUTHORITY\SYSTEM 11241100x800000000000000011903Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.511{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ComponentModel.Primitives.dll2025-10-29 13:30:53.511NT AUTHORITY\SYSTEM 11241100x800000000000000011904Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.513{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ComponentModel.TypeConverter.dll2025-10-29 13:30:53.513NT AUTHORITY\SYSTEM 11241100x800000000000000011905Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.513{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Configuration.ConfigurationManager.dll2025-10-29 13:30:53.513NT AUTHORITY\SYSTEM 11241100x800000000000000011906Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.513{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Configuration.dll2025-10-29 13:30:53.513NT AUTHORITY\SYSTEM 11241100x800000000000000011907Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.513{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Console.dll2025-10-29 13:30:53.513NT AUTHORITY\SYSTEM 11241100x800000000000000011908Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.513{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Core.dll2025-10-29 13:30:53.513NT AUTHORITY\SYSTEM 11241100x800000000000000011909Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.515{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Data.Common.dll2025-10-29 13:30:53.515NT AUTHORITY\SYSTEM 11241100x800000000000000011910Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.515{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Data.DataSetExtensions.dll2025-10-29 13:30:53.515NT AUTHORITY\SYSTEM 11241100x800000000000000011911Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.515{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Data.dll2025-10-29 13:30:53.515NT AUTHORITY\SYSTEM 11241100x800000000000000011912Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.515{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Data.Odbc.dll2025-10-29 13:30:53.515NT AUTHORITY\SYSTEM 11241100x800000000000000011913Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.515{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Data.OleDb.dll2025-10-29 13:30:53.515NT AUTHORITY\SYSTEM 11241100x800000000000000011914Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.515{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Data.SqlClient.dll2025-10-29 13:30:53.515NT AUTHORITY\SYSTEM 11241100x800000000000000011915Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.517{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.Contracts.dll2025-10-29 13:30:53.517NT AUTHORITY\SYSTEM 11241100x800000000000000011916Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.517{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.Debug.dll2025-10-29 13:30:53.517NT AUTHORITY\SYSTEM 11241100x800000000000000011917Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.517{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.DiagnosticSource.dll2025-10-29 13:30:53.517NT AUTHORITY\SYSTEM 11241100x800000000000000011918Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.517{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.EventLog.dll2025-10-29 13:30:53.517NT AUTHORITY\SYSTEM 11241100x800000000000000011919Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.519{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.FileVersionInfo.dll2025-10-29 13:30:53.519NT AUTHORITY\SYSTEM 11241100x800000000000000011920Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.519{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.PerformanceCounter.dll2025-10-29 13:30:53.519NT AUTHORITY\SYSTEM 11241100x800000000000000011921Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.519{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.Process.dll2025-10-29 13:30:53.519NT AUTHORITY\SYSTEM 11241100x800000000000000011922Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.519{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.StackTrace.dll2025-10-29 13:30:53.519NT AUTHORITY\SYSTEM 11241100x800000000000000011923Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.519{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.TextWriterTraceListener.dll2025-10-29 13:30:53.519NT AUTHORITY\SYSTEM 11241100x800000000000000011924Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.521{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.Tools.dll2025-10-29 13:30:53.521NT AUTHORITY\SYSTEM 11241100x800000000000000011925Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.521{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.TraceSource.dll2025-10-29 13:30:53.521NT AUTHORITY\SYSTEM 11241100x800000000000000011926Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.521{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Diagnostics.Tracing.dll2025-10-29 13:30:53.521NT AUTHORITY\SYSTEM 11241100x800000000000000011927Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.521{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.DirectoryServices.AccountManagement.dll2025-10-29 13:30:53.521NT AUTHORITY\SYSTEM 11241100x800000000000000011928Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.521{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.DirectoryServices.dll2025-10-29 13:30:53.521NT AUTHORITY\SYSTEM 11241100x800000000000000011929Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.523{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.DirectoryServices.Protocols.dll2025-10-29 13:30:53.523NT AUTHORITY\SYSTEM 11241100x800000000000000011930Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.523{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.dll2025-10-29 13:30:53.523NT AUTHORITY\SYSTEM 11241100x800000000000000011931Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.523{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Drawing.Common.dll2025-10-29 13:30:53.523NT AUTHORITY\SYSTEM 11241100x800000000000000011932Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.523{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Drawing.dll2025-10-29 13:30:53.523NT AUTHORITY\SYSTEM 11241100x800000000000000011933Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.523{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Drawing.Primitives.dll2025-10-29 13:30:53.523NT AUTHORITY\SYSTEM 11241100x800000000000000011934Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.523{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Dynamic.Runtime.dll2025-10-29 13:30:53.523NT AUTHORITY\SYSTEM 11241100x800000000000000011935Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.525{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Formats.Asn1.dll2025-10-29 13:30:53.523NT AUTHORITY\SYSTEM 11241100x800000000000000011936Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.525{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Globalization.Calendars.dll2025-10-29 13:30:53.525NT AUTHORITY\SYSTEM 11241100x800000000000000011937Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.525{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Globalization.dll2025-10-29 13:30:53.525NT AUTHORITY\SYSTEM 11241100x800000000000000011938Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.525{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Globalization.Extensions.dll2025-10-29 13:30:53.525NT AUTHORITY\SYSTEM 11241100x800000000000000011939Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.525{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IdentityModel.Tokens.Jwt.dll2025-10-29 13:30:53.525NT AUTHORITY\SYSTEM 11241100x800000000000000011940Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.527{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.Compression.Brotli.dll2025-10-29 13:30:53.527NT AUTHORITY\SYSTEM 11241100x800000000000000011941Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.527{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.Compression.dll2025-10-29 13:30:53.527NT AUTHORITY\SYSTEM 11241100x800000000000000011942Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.527{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.Compression.FileSystem.dll2025-10-29 13:30:53.527NT AUTHORITY\SYSTEM 11241100x800000000000000011943Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.527{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.Compression.Native.dll2025-10-29 13:30:53.527NT AUTHORITY\SYSTEM 11241100x800000000000000011944Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.527{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.Compression.ZipFile.dll2025-10-29 13:30:53.527NT AUTHORITY\SYSTEM 11241100x800000000000000011945Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.527{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.dll2025-10-29 13:30:53.527NT AUTHORITY\SYSTEM 11241100x800000000000000011946Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.529{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.FileSystem.AccessControl.dll2025-10-29 13:30:53.529NT AUTHORITY\SYSTEM 11241100x800000000000000011947Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.529{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.FileSystem.dll2025-10-29 13:30:53.529NT AUTHORITY\SYSTEM 11241100x800000000000000011948Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.529{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.FileSystem.DriveInfo.dll2025-10-29 13:30:53.529NT AUTHORITY\SYSTEM 11241100x800000000000000011949Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.529{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.FileSystem.Primitives.dll2025-10-29 13:30:53.529NT AUTHORITY\SYSTEM 11241100x800000000000000011950Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.529{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.FileSystem.Watcher.dll2025-10-29 13:30:53.529NT AUTHORITY\SYSTEM 11241100x800000000000000011951Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.529{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.IsolatedStorage.dll2025-10-29 13:30:53.529NT AUTHORITY\SYSTEM 11241100x800000000000000011952Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.531{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.MemoryMappedFiles.dll2025-10-29 13:30:53.531NT AUTHORITY\SYSTEM 11241100x800000000000000011953Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.531{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.Packaging.dll2025-10-29 13:30:53.531NT AUTHORITY\SYSTEM 11241100x800000000000000011954Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.531{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.Pipes.AccessControl.dll2025-10-29 13:30:53.531NT AUTHORITY\SYSTEM 11241100x800000000000000011955Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.531{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.Pipes.dll2025-10-29 13:30:53.531NT AUTHORITY\SYSTEM 11241100x800000000000000011956Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.533{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.Ports.dll2025-10-29 13:30:53.531NT AUTHORITY\SYSTEM 11241100x800000000000000011957Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.533{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.IO.UnmanagedMemoryStream.dll2025-10-29 13:30:53.533NT AUTHORITY\SYSTEM 11241100x800000000000000011958Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.533{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Linq.dll2025-10-29 13:30:53.533NT AUTHORITY\SYSTEM 11241100x800000000000000011959Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.533{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Linq.Expressions.dll2025-10-29 13:30:53.533NT AUTHORITY\SYSTEM 11241100x800000000000000011960Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.533{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Linq.Parallel.dll2025-10-29 13:30:53.533NT AUTHORITY\SYSTEM 11241100x800000000000000011961Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.533{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Linq.Queryable.dll2025-10-29 13:30:53.533NT AUTHORITY\SYSTEM 11241100x800000000000000011962Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.535{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Management.Automation.dll2025-10-29 13:30:53.533NT AUTHORITY\SYSTEM 11241100x800000000000000011963Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.535{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Management.dll2025-10-29 13:30:53.535NT AUTHORITY\SYSTEM 11241100x800000000000000011964Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.535{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Memory.dll2025-10-29 13:30:53.535NT AUTHORITY\SYSTEM 11241100x800000000000000011965Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.535{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.dll2025-10-29 13:30:53.535NT AUTHORITY\SYSTEM 11241100x800000000000000011966Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.535{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.Http.dll2025-10-29 13:30:53.535NT AUTHORITY\SYSTEM 11241100x800000000000000011967Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.535{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.Http.Json.dll2025-10-29 13:30:53.535NT AUTHORITY\SYSTEM 11241100x800000000000000011968Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.535{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.Http.WinHttpHandler.dll2025-10-29 13:30:53.535NT AUTHORITY\SYSTEM 11241100x800000000000000011969Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.537{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.HttpListener.dll2025-10-29 13:30:53.537NT AUTHORITY\SYSTEM 11241100x800000000000000011970Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.537{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.Mail.dll2025-10-29 13:30:53.537NT AUTHORITY\SYSTEM 11241100x800000000000000011971Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.537{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.NameResolution.dll2025-10-29 13:30:53.537NT AUTHORITY\SYSTEM 11241100x800000000000000011972Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.537{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.NetworkInformation.dll2025-10-29 13:30:53.537NT AUTHORITY\SYSTEM 11241100x800000000000000011973Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.537{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.Ping.dll2025-10-29 13:30:53.537NT AUTHORITY\SYSTEM 11241100x800000000000000011974Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.539{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.Primitives.dll2025-10-29 13:30:53.537NT AUTHORITY\SYSTEM 11241100x800000000000000011975Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.539{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.Quic.dll2025-10-29 13:30:53.539NT AUTHORITY\SYSTEM 11241100x800000000000000011976Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.539{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.Requests.dll2025-10-29 13:30:53.539NT AUTHORITY\SYSTEM 11241100x800000000000000011977Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.539{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.Security.dll2025-10-29 13:30:53.539NT AUTHORITY\SYSTEM 11241100x800000000000000011978Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.539{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.ServicePoint.dll2025-10-29 13:30:53.539NT AUTHORITY\SYSTEM 11241100x800000000000000011979Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.539{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.Sockets.dll2025-10-29 13:30:53.539NT AUTHORITY\SYSTEM 11241100x800000000000000011980Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.539{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.WebClient.dll2025-10-29 13:30:53.539NT AUTHORITY\SYSTEM 11241100x800000000000000011981Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.541{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.WebHeaderCollection.dll2025-10-29 13:30:53.541NT AUTHORITY\SYSTEM 11241100x800000000000000011982Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.541{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.WebProxy.dll2025-10-29 13:30:53.541NT AUTHORITY\SYSTEM 11241100x800000000000000011983Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.541{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.WebSockets.Client.dll2025-10-29 13:30:53.541NT AUTHORITY\SYSTEM 11241100x800000000000000011984Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.541{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Net.WebSockets.dll2025-10-29 13:30:53.541NT AUTHORITY\SYSTEM 11241100x800000000000000011985Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.541{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Numerics.dll2025-10-29 13:30:53.541NT AUTHORITY\SYSTEM 11241100x800000000000000011986Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.543{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Numerics.Vectors.dll2025-10-29 13:30:53.543NT AUTHORITY\SYSTEM 11241100x800000000000000011987Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.543{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ObjectModel.dll2025-10-29 13:30:53.543NT AUTHORITY\SYSTEM 11241100x800000000000000011988Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.543{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Private.CoreLib.dll2025-10-29 13:30:53.543NT AUTHORITY\SYSTEM 11241100x800000000000000011989Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.543{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Private.DataContractSerialization.dll2025-10-29 13:30:53.543NT AUTHORITY\SYSTEM 11241100x800000000000000011990Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.543{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Private.ServiceModel.dll2025-10-29 13:30:53.543NT AUTHORITY\SYSTEM 11241100x800000000000000011991Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.545{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Private.Uri.dll2025-10-29 13:30:53.545NT AUTHORITY\SYSTEM 11241100x800000000000000011992Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.545{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Private.Xml.dll2025-10-29 13:30:53.545NT AUTHORITY\SYSTEM 11241100x800000000000000011993Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.545{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Private.Xml.Linq.dll2025-10-29 13:30:53.545NT AUTHORITY\SYSTEM 11241100x800000000000000011994Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.545{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Reflection.Context.dll2025-10-29 13:30:53.545NT AUTHORITY\SYSTEM 11241100x800000000000000011995Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.545{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Reflection.DispatchProxy.dll2025-10-29 13:30:53.545NT AUTHORITY\SYSTEM 11241100x800000000000000011996Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.547{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Reflection.dll2025-10-29 13:30:53.547NT AUTHORITY\SYSTEM 11241100x800000000000000011997Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.547{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Reflection.Emit.dll2025-10-29 13:30:53.547NT AUTHORITY\SYSTEM 11241100x800000000000000011998Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.547{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Reflection.Emit.ILGeneration.dll2025-10-29 13:30:53.547NT AUTHORITY\SYSTEM 11241100x800000000000000011999Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.547{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Reflection.Emit.Lightweight.dll2025-10-29 13:30:53.547NT AUTHORITY\SYSTEM 11241100x800000000000000012000Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.549{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Reflection.Extensions.dll2025-10-29 13:30:53.547NT AUTHORITY\SYSTEM 11241100x800000000000000012001Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.549{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Reflection.Metadata.dll2025-10-29 13:30:53.549NT AUTHORITY\SYSTEM 11241100x800000000000000012002Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.549{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Reflection.Primitives.dll2025-10-29 13:30:53.549NT AUTHORITY\SYSTEM 11241100x800000000000000012003Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.549{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Reflection.TypeExtensions.dll2025-10-29 13:30:53.549NT AUTHORITY\SYSTEM 11241100x800000000000000012004Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.549{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Resources.Reader.dll2025-10-29 13:30:53.549NT AUTHORITY\SYSTEM 11241100x800000000000000012005Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.549{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Resources.ResourceManager.dll2025-10-29 13:30:53.549NT AUTHORITY\SYSTEM 11241100x800000000000000012006Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.551{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Resources.Writer.dll2025-10-29 13:30:53.551NT AUTHORITY\SYSTEM 11241100x800000000000000012007Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.551{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.Caching.dll2025-10-29 13:30:53.551NT AUTHORITY\SYSTEM 11241100x800000000000000012008Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.551{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.CompilerServices.Unsafe.dll2025-10-29 13:30:53.551NT AUTHORITY\SYSTEM 11241100x800000000000000012009Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.551{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.CompilerServices.VisualC.dll2025-10-29 13:30:53.551NT AUTHORITY\SYSTEM 11241100x800000000000000012010Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.551{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.dll2025-10-29 13:30:53.551NT AUTHORITY\SYSTEM 11241100x800000000000000012011Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.553{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.Extensions.dll2025-10-29 13:30:53.551NT AUTHORITY\SYSTEM 11241100x800000000000000012012Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.553{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.Handles.dll2025-10-29 13:30:53.553NT AUTHORITY\SYSTEM 11241100x800000000000000012013Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.553{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.InteropServices.dll2025-10-29 13:30:53.553NT AUTHORITY\SYSTEM 11241100x800000000000000012014Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.553{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.InteropServices.RuntimeInformation.dll2025-10-29 13:30:53.553NT AUTHORITY\SYSTEM 11241100x800000000000000012015Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.553{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.Intrinsics.dll2025-10-29 13:30:53.553NT AUTHORITY\SYSTEM 11241100x800000000000000012016Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.553{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.Loader.dll2025-10-29 13:30:53.553NT AUTHORITY\SYSTEM 11241100x800000000000000012017Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.555{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.Numerics.dll2025-10-29 13:30:53.555NT AUTHORITY\SYSTEM 11241100x800000000000000012018Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.555{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.Serialization.dll2025-10-29 13:30:53.555NT AUTHORITY\SYSTEM 11241100x800000000000000012019Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.555{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.Serialization.Formatters.dll2025-10-29 13:30:53.555NT AUTHORITY\SYSTEM 11241100x800000000000000012020Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.555{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.Serialization.Json.dll2025-10-29 13:30:53.555NT AUTHORITY\SYSTEM 11241100x800000000000000012021Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.555{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.Serialization.Primitives.dll2025-10-29 13:30:53.555NT AUTHORITY\SYSTEM 11241100x800000000000000012022Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.555{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Runtime.Serialization.Xml.dll2025-10-29 13:30:53.555NT AUTHORITY\SYSTEM 11241100x800000000000000012023Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.557{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.AccessControl.dll2025-10-29 13:30:53.557NT AUTHORITY\SYSTEM 11241100x800000000000000012024Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.557{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Claims.dll2025-10-29 13:30:53.557NT AUTHORITY\SYSTEM 11241100x800000000000000012025Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.557{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Algorithms.dll2025-10-29 13:30:53.557NT AUTHORITY\SYSTEM 11241100x800000000000000012026Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.559{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Cng.dll2025-10-29 13:30:53.557NT AUTHORITY\SYSTEM 11241100x800000000000000012027Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.559{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Csp.dll2025-10-29 13:30:53.559NT AUTHORITY\SYSTEM 11241100x800000000000000012028Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.559{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Encoding.dll2025-10-29 13:30:53.559NT AUTHORITY\SYSTEM 11241100x800000000000000012029Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.559{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.OpenSsl.dll2025-10-29 13:30:53.559NT AUTHORITY\SYSTEM 11241100x800000000000000012030Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.559{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Pkcs.dll2025-10-29 13:30:53.559NT AUTHORITY\SYSTEM 11241100x800000000000000012031Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.561{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Primitives.dll2025-10-29 13:30:53.561NT AUTHORITY\SYSTEM 11241100x800000000000000012032Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.561{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.ProtectedData.dll2025-10-29 13:30:53.561NT AUTHORITY\SYSTEM 11241100x800000000000000012033Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.561{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.X509Certificates.dll2025-10-29 13:30:53.561NT AUTHORITY\SYSTEM 11241100x800000000000000012034Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.561{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Xml.dll2025-10-29 13:30:53.561NT AUTHORITY\SYSTEM 11241100x800000000000000012035Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.561{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.dll2025-10-29 13:30:53.561NT AUTHORITY\SYSTEM 11241100x800000000000000012036Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.563{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Permissions.dll2025-10-29 13:30:53.561NT AUTHORITY\SYSTEM 11241100x800000000000000012037Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.563{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Principal.dll2025-10-29 13:30:53.563NT AUTHORITY\SYSTEM 11241100x800000000000000012038Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.563{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.Principal.Windows.dll2025-10-29 13:30:53.563NT AUTHORITY\SYSTEM 11241100x800000000000000012039Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.563{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Security.SecureString.dll2025-10-29 13:30:53.563NT AUTHORITY\SYSTEM 11241100x800000000000000012040Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.563{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ServiceModel.Syndication.dll2025-10-29 13:30:53.563NT AUTHORITY\SYSTEM 11241100x800000000000000012041Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.563{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ServiceModel.Web.dll2025-10-29 13:30:53.563NT AUTHORITY\SYSTEM 11241100x800000000000000012042Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.563{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ServiceProcess.dll2025-10-29 13:30:53.563NT AUTHORITY\SYSTEM 11241100x800000000000000012043Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.565{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ServiceProcess.ServiceController.dll2025-10-29 13:30:53.565NT AUTHORITY\SYSTEM 11241100x800000000000000012044Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.565{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Speech.dll2025-10-29 13:30:53.565NT AUTHORITY\SYSTEM 11241100x800000000000000012045Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.565{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Text.Encoding.CodePages.dll2025-10-29 13:30:53.565NT AUTHORITY\SYSTEM 11241100x800000000000000012046Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.565{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Text.Encoding.dll2025-10-29 13:30:53.565NT AUTHORITY\SYSTEM 11241100x800000000000000012047Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.565{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Text.Encoding.Extensions.dll2025-10-29 13:30:53.565NT AUTHORITY\SYSTEM 11241100x800000000000000012048Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.565{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Text.Encodings.Web.dll2025-10-29 13:30:53.565NT AUTHORITY\SYSTEM 11241100x800000000000000012049Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.567{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Text.Json.dll2025-10-29 13:30:53.567NT AUTHORITY\SYSTEM 11241100x800000000000000012050Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.567{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Text.RegularExpressions.dll2025-10-29 13:30:53.567NT AUTHORITY\SYSTEM 11241100x800000000000000012051Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.567{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Threading.AccessControl.dll2025-10-29 13:30:53.567NT AUTHORITY\SYSTEM 11241100x800000000000000012052Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.567{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Threading.Channels.dll2025-10-29 13:30:53.567NT AUTHORITY\SYSTEM 11241100x800000000000000012053Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.567{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Threading.dll2025-10-29 13:30:53.567NT AUTHORITY\SYSTEM 11241100x800000000000000012054Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.567{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Threading.Overlapped.dll2025-10-29 13:30:53.567NT AUTHORITY\SYSTEM 11241100x800000000000000012055Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.569{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Threading.Tasks.Dataflow.dll2025-10-29 13:30:53.567NT AUTHORITY\SYSTEM 11241100x800000000000000012056Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.569{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Threading.Tasks.dll2025-10-29 13:30:53.569NT AUTHORITY\SYSTEM 11241100x800000000000000012057Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.569{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Threading.Tasks.Extensions.dll2025-10-29 13:30:53.569NT AUTHORITY\SYSTEM 11241100x800000000000000012058Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.569{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Threading.Tasks.Parallel.dll2025-10-29 13:30:53.569NT AUTHORITY\SYSTEM 11241100x800000000000000012059Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.569{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Threading.Thread.dll2025-10-29 13:30:53.569NT AUTHORITY\SYSTEM 11241100x800000000000000012060Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.569{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Threading.ThreadPool.dll2025-10-29 13:30:53.569NT AUTHORITY\SYSTEM 11241100x800000000000000012061Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.569{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Threading.Timer.dll2025-10-29 13:30:53.569NT AUTHORITY\SYSTEM 11241100x800000000000000012062Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.571{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Transactions.dll2025-10-29 13:30:53.571NT AUTHORITY\SYSTEM 11241100x800000000000000012063Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.571{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Transactions.Local.dll2025-10-29 13:30:53.571NT AUTHORITY\SYSTEM 11241100x800000000000000012064Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.571{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.ValueTuple.dll2025-10-29 13:30:53.571NT AUTHORITY\SYSTEM 11241100x800000000000000012065Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.571{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Web.dll2025-10-29 13:30:53.571NT AUTHORITY\SYSTEM 11241100x800000000000000012066Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.573{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Web.HttpUtility.dll2025-10-29 13:30:53.571NT AUTHORITY\SYSTEM 11241100x800000000000000012067Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.573{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Web.Services.Description.dll2025-10-29 13:30:53.573NT AUTHORITY\SYSTEM 11241100x800000000000000012068Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.573{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Windows.dll2025-10-29 13:30:53.573NT AUTHORITY\SYSTEM 11241100x800000000000000012069Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.573{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Windows.Extensions.dll2025-10-29 13:30:53.573NT AUTHORITY\SYSTEM 11241100x800000000000000012070Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.573{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Xml.dll2025-10-29 13:30:53.573NT AUTHORITY\SYSTEM 11241100x800000000000000012071Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.574{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Xml.Linq.dll2025-10-29 13:30:53.574NT AUTHORITY\SYSTEM 11241100x800000000000000012072Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.574{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Xml.ReaderWriter.dll2025-10-29 13:30:53.574NT AUTHORITY\SYSTEM 11241100x800000000000000012073Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.574{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Xml.Serialization.dll2025-10-29 13:30:53.574NT AUTHORITY\SYSTEM 11241100x800000000000000012074Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.576{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Xml.XDocument.dll2025-10-29 13:30:53.576NT AUTHORITY\SYSTEM 11241100x800000000000000012075Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.576{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Xml.XmlDocument.dll2025-10-29 13:30:53.576NT AUTHORITY\SYSTEM 11241100x800000000000000012076Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.576{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Xml.XmlSerializer.dll2025-10-29 13:30:53.576NT AUTHORITY\SYSTEM 11241100x800000000000000012077Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.576{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Xml.XPath.dll2025-10-29 13:30:53.576NT AUTHORITY\SYSTEM 11241100x800000000000000012078Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.578{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\System.Xml.XPath.XDocument.dll2025-10-29 13:30:53.576NT AUTHORITY\SYSTEM 11241100x800000000000000012079Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.578{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\VelocityLibrary.dll2025-10-29 13:30:53.578NT AUTHORITY\SYSTEM 11241100x800000000000000012080Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.578{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\WebView2Loader.dll2025-10-29 13:30:53.578NT AUTHORITY\SYSTEM 11241100x800000000000000012081Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.578{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\WindowsBase.dll2025-10-29 13:30:53.578NT AUTHORITY\SYSTEM 11241100x800000000000000012082Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:53.580{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\WinRT.Runtime.dll2025-10-29 13:30:53.578NT AUTHORITY\SYSTEM 11241100x800000000000000012083Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.197{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\AIServices.dll2025-10-29 13:30:54.197NT AUTHORITY\SYSTEM 11241100x800000000000000012084Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.197{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\AIServicesCS.dll2025-10-29 13:30:54.197NT AUTHORITY\SYSTEM 11241100x800000000000000012085Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.197{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\AIStore.dll2025-10-29 13:30:54.197NT AUTHORITY\SYSTEM 11241100x800000000000000012086Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.199{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\BasePaint.dll2025-10-29 13:30:54.197NT AUTHORITY\SYSTEM 11241100x800000000000000012087Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.199{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\EnumHelper.dll2025-10-29 13:30:54.199NT AUTHORITY\SYSTEM 11241100x800000000000000012088Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.199{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\ExplorerCommand.dll2025-10-29 13:30:54.199NT AUTHORITY\SYSTEM 11241100x800000000000000012089Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.199{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\FeatureStaging.dll2025-10-29 13:30:54.199NT AUTHORITY\SYSTEM 11241100x800000000000000012090Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.199{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\ImageProcessing.dll2025-10-29 13:30:54.199NT AUTHORITY\SYSTEM 11241100x800000000000000012091Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:30:54.201{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\mspaint.exe2025-10-29 13:30:54.199NT AUTHORITY\SYSTEM 11241100x800000000000000012092Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.201{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\PaintAIManager.dll2025-10-29 13:30:54.201NT AUTHORITY\SYSTEM 11241100x800000000000000012093Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.201{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\PaintTools.dll2025-10-29 13:30:54.201NT AUTHORITY\SYSTEM 11241100x800000000000000012094Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.201{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\PaintUI.dll2025-10-29 13:30:54.201NT AUTHORITY\SYSTEM 11241100x800000000000000012095Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.203{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\PerceptiveShell\magerapi.dll2025-10-29 13:30:54.203NT AUTHORITY\SYSTEM 11241100x800000000000000012096Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.203{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\PerceptiveShell\NPUDetect.dll2025-10-29 13:30:54.203NT AUTHORITY\SYSTEM 11241100x800000000000000012097Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.203{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\PerceptiveShell\segapi.dll2025-10-29 13:30:54.203NT AUTHORITY\SYSTEM 11241100x800000000000000012098Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.203{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\PGS.dll2025-10-29 13:30:54.203NT AUTHORITY\SYSTEM 11241100x800000000000000012099Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.205{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\PlatformHelpers.dll2025-10-29 13:30:54.205NT AUTHORITY\SYSTEM 11241100x800000000000000012100Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.205{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\ProjectFile.dll2025-10-29 13:30:54.205NT AUTHORITY\SYSTEM 11241100x800000000000000012101Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.205{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\ProvenanceHelper.dll2025-10-29 13:30:54.205NT AUTHORITY\SYSTEM 11241100x800000000000000012102Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.205{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\Reporting.dll2025-10-29 13:30:54.205NT AUTHORITY\SYSTEM 11241100x800000000000000012103Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.205{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\PaintApp\RestartRecovery.dll2025-10-29 13:30:54.205NT AUTHORITY\SYSTEM 11241100x800000000000000012104Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:54.207{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{3A34E2CC-E6B4-441E-9B22-BCEBFCF5E497}\ssshim.dll2025-10-29 13:30:54.207NT AUTHORITY\SYSTEM 11241100x800000000000000012105Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.203{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\ConnectedDevicesDevKit.Projection.dll2025-10-29 13:30:56.203NT AUTHORITY\SYSTEM 11241100x800000000000000012106Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.203{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Clipboard.dll2025-10-29 13:30:56.203NT AUTHORITY\SYSTEM 11241100x800000000000000012107Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.205{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Clipboard.Protocol.dll2025-10-29 13:30:56.205NT AUTHORITY\SYSTEM 11241100x800000000000000012108Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.205{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.ConnectedDevicesExperience.dll2025-10-29 13:30:56.205NT AUTHORITY\SYSTEM 11241100x800000000000000012109Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.205{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Continuity.dll2025-10-29 13:30:56.205NT AUTHORITY\SYSTEM 11241100x800000000000000012110Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.205{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Continuity.Protocol.dll2025-10-29 13:30:56.205NT AUTHORITY\SYSTEM 11241100x800000000000000012111Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.205{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Contracts.Continuity.dll2025-10-29 13:30:56.205NT AUTHORITY\SYSTEM 11241100x800000000000000012112Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.207{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Contracts.Devices.dll2025-10-29 13:30:56.207NT AUTHORITY\SYSTEM 11241100x800000000000000012113Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.207{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Contracts.Files.dll2025-10-29 13:30:56.207NT AUTHORITY\SYSTEM 11241100x800000000000000012114Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.207{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Contracts.Files.ProxyStub.dll2025-10-29 13:30:56.207NT AUTHORITY\SYSTEM 11241100x800000000000000012115Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.207{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Contracts.Platform.dll2025-10-29 13:30:56.207NT AUTHORITY\SYSTEM 11241100x800000000000000012116Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.207{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Contracts.Settings.dll2025-10-29 13:30:56.207NT AUTHORITY\SYSTEM 11241100x800000000000000012117Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.207{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Contracts.Settings.ProxyStub.dll2025-10-29 13:30:56.207NT AUTHORITY\SYSTEM 11241100x800000000000000012118Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.207{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Contracts.Share.dll2025-10-29 13:30:56.207NT AUTHORITY\SYSTEM 11241100x800000000000000012119Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.209{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Contracts.Share.ProxyStub.dll2025-10-29 13:30:56.209NT AUTHORITY\SYSTEM 11241100x800000000000000012120Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.209{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Contracts.Streaming.dll2025-10-29 13:30:56.209NT AUTHORITY\SYSTEM 11241100x800000000000000012121Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.209{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Contracts.Streaming.ProxyStub.dll2025-10-29 13:30:56.209NT AUTHORITY\SYSTEM 11241100x800000000000000012122Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.209{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Core.dll2025-10-29 13:30:56.209NT AUTHORITY\SYSTEM 11241100x800000000000000012123Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.209{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Core.Projection.dll2025-10-29 13:30:56.209NT AUTHORITY\SYSTEM 11241100x800000000000000012124Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.209{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Core.ProxyStub.dll2025-10-29 13:30:56.209NT AUTHORITY\SYSTEM 11241100x800000000000000012125Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.211{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Core.UX.dll2025-10-29 13:30:56.209NT AUTHORITY\SYSTEM 11241100x800000000000000012126Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.211{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Core.WinRT.dll2025-10-29 13:30:56.211NT AUTHORITY\SYSTEM 11241100x800000000000000012127Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.211{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Devices.dll2025-10-29 13:30:56.211NT AUTHORITY\SYSTEM 11241100x800000000000000012128Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.211{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Devices.Protocol.dll2025-10-29 13:30:56.211NT AUTHORITY\SYSTEM 11241100x800000000000000012129Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.213{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.DevKit.ProxyStub.dll2025-10-29 13:30:56.211NT AUTHORITY\SYSTEM 11241100x800000000000000012130Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.213{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Files.dll2025-10-29 13:30:56.213NT AUTHORITY\SYSTEM 11241100x800000000000000012131Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.213{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Files.Protocol.dll2025-10-29 13:30:56.213NT AUTHORITY\SYSTEM 11241100x800000000000000012132Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.213{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Platform.dll2025-10-29 13:30:56.213NT AUTHORITY\SYSTEM 11241100x800000000000000012133Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.213{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Platform.Protocol.dll2025-10-29 13:30:56.213NT AUTHORITY\SYSTEM 11241100x800000000000000012134Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.213{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.RemoteControl.dll2025-10-29 13:30:56.213NT AUTHORITY\SYSTEM 11241100x800000000000000012135Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.214{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.RemoteControl.Protocol.dll2025-10-29 13:30:56.214NT AUTHORITY\SYSTEM 11241100x800000000000000012136Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.214{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.RemoteSnipping.dll2025-10-29 13:30:56.214NT AUTHORITY\SYSTEM 11241100x800000000000000012137Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.214{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.RemoteSnipping.Protocol.dll2025-10-29 13:30:56.214NT AUTHORITY\SYSTEM 11241100x800000000000000012138Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.214{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Settings.dll2025-10-29 13:30:56.214NT AUTHORITY\SYSTEM 11241100x800000000000000012139Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.216{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Share.dll2025-10-29 13:30:56.214NT AUTHORITY\SYSTEM 11241100x800000000000000012140Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.216{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Share.Protocol.dll2025-10-29 13:30:56.216NT AUTHORITY\SYSTEM 11241100x800000000000000012141Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.216{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Streaming.dll2025-10-29 13:30:56.216NT AUTHORITY\SYSTEM 11241100x800000000000000012142Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.216{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Streaming.Projection.dll2025-10-29 13:30:56.216NT AUTHORITY\SYSTEM 11241100x800000000000000012143Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.218{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Streaming.Protocol.dll2025-10-29 13:30:56.218NT AUTHORITY\SYSTEM 11241100x800000000000000012144Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.218{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Streaming.Source.dll2025-10-29 13:30:56.218NT AUTHORITY\SYSTEM 11241100x800000000000000012145Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.218{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDevice.Streaming.WinRT.dll2025-10-29 13:30:56.218NT AUTHORITY\SYSTEM 11241100x800000000000000012146Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.218{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDeviceFilesHost.dll2025-10-29 13:30:56.218NT AUTHORITY\SYSTEM 11241100x800000000000000012147Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:30:56.218{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDeviceFilesHost.exe2025-10-29 13:30:56.218NT AUTHORITY\SYSTEM 11241100x800000000000000012148Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.220{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDeviceService.dll2025-10-29 13:30:56.220NT AUTHORITY\SYSTEM 11241100x800000000000000012149Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:30:56.220{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDeviceService.exe2025-10-29 13:30:56.220NT AUTHORITY\SYSTEM 11241100x800000000000000012150Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.220{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDeviceSettingsHost.dll2025-10-29 13:30:56.220NT AUTHORITY\SYSTEM 11241100x800000000000000012151Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:30:56.220{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDeviceSettingsHost.exe2025-10-29 13:30:56.220NT AUTHORITY\SYSTEM 11241100x800000000000000012152Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.222{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDeviceStreamingHost.dll2025-10-29 13:30:56.222NT AUTHORITY\SYSTEM 11241100x800000000000000012153Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:30:56.222{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\CrossDeviceStreamingHost.exe2025-10-29 13:30:56.222NT AUTHORITY\SYSTEM 11241100x800000000000000012154Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.222{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\LibNanoAPI.Projection.dll2025-10-29 13:30:56.222NT AUTHORITY\SYSTEM 11241100x800000000000000012155Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.224{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\Microsoft.Graphics.Canvas.Interop.dll2025-10-29 13:30:56.222NT AUTHORITY\SYSTEM 11241100x800000000000000012156Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.224{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\Microsoft.InteractiveExperiences.Projection.dll2025-10-29 13:30:56.224NT AUTHORITY\SYSTEM 11241100x800000000000000012157Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.224{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\Microsoft.Windows.ApplicationModel.Resources.Projection.dll2025-10-29 13:30:56.224NT AUTHORITY\SYSTEM 11241100x800000000000000012158Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.224{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\Microsoft.Windows.AppLifecycle.Projection.dll2025-10-29 13:30:56.224NT AUTHORITY\SYSTEM 11241100x800000000000000012159Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.224{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\Microsoft.Windows.SDK.NET.dll2025-10-29 13:30:56.224NT AUTHORITY\SYSTEM 11241100x800000000000000012160Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.224{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\Microsoft.WinUI.dll2025-10-29 13:30:56.224NT AUTHORITY\SYSTEM 11241100x800000000000000012161Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.226{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\SharedUtilities.Controls.dll2025-10-29 13:30:56.224NT AUTHORITY\SYSTEM 11241100x800000000000000012162Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.226{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\SharedUtilities.dll2025-10-29 13:30:56.226NT AUTHORITY\SYSTEM 11241100x800000000000000012163Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.226{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\SharedUtilities.QrCodeGenerator.dll2025-10-29 13:30:56.226NT AUTHORITY\SYSTEM 11241100x800000000000000012164Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.226{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\SharedUtilities.WExp.dll2025-10-29 13:30:56.226NT AUTHORITY\SYSTEM 11241100x800000000000000012165Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.226{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\System.Collections.Concurrent.dll2025-10-29 13:30:56.226NT AUTHORITY\SYSTEM 11241100x800000000000000012166Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.226{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\System.Numerics.Vectors.dll2025-10-29 13:30:56.226NT AUTHORITY\SYSTEM 11241100x800000000000000012167Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.226{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\System.Private.CoreLib.dll2025-10-29 13:30:56.226NT AUTHORITY\SYSTEM 11241100x800000000000000012168Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.229{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\System.Runtime.dll2025-10-29 13:30:56.226NT AUTHORITY\SYSTEM 11241100x800000000000000012169Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.229{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\System.Security.Cryptography.dll2025-10-29 13:30:56.229NT AUTHORITY\SYSTEM 11241100x800000000000000012170Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.229{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\WindowsUdk.dll2025-10-29 13:30:56.229NT AUTHORITY\SYSTEM 11241100x800000000000000012171Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.229{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\WinRT.Runtime.dll2025-10-29 13:30:56.229NT AUTHORITY\SYSTEM 11241100x800000000000000012172Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.229{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\YourPhone.OnboardingSDK.dll2025-10-29 13:30:56.229NT AUTHORITY\SYSTEM 11241100x800000000000000012173Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.229{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\YourPhone.YPP.Auth.dll2025-10-29 13:30:56.229NT AUTHORITY\SYSTEM 11241100x800000000000000012174Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.230{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\YourPhone.YPP.Bluetooth.dll2025-10-29 13:30:56.229NT AUTHORITY\SYSTEM 11241100x800000000000000012175Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.230{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\YourPhone.YPP.Common.dll2025-10-29 13:30:56.230NT AUTHORITY\SYSTEM 11241100x800000000000000012176Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.230{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\YourPhone.YPP.dll2025-10-29 13:30:56.230NT AUTHORITY\SYSTEM 11241100x800000000000000012177Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.230{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\YourPhone.YPP.Onboarding.dll2025-10-29 13:30:56.230NT AUTHORITY\SYSTEM 11241100x800000000000000012178Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.230{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\YourPhone.YPP.PlatformSdk.dll2025-10-29 13:30:56.230NT AUTHORITY\SYSTEM 11241100x800000000000000012179Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.230{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\YourPhone.YPP.PlatformSdk.Protocol.dll2025-10-29 13:30:56.230NT AUTHORITY\SYSTEM 11241100x800000000000000012180Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.230{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\YourPhone.YPP.ServicesClient.dll2025-10-29 13:30:56.230NT AUTHORITY\SYSTEM 11241100x800000000000000012181Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:30:56.232{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\YourPhone.YPP.Shims.dll2025-10-29 13:30:56.232NT AUTHORITY\SYSTEM 154100x800000000000000012182Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:31:01.304{8223a6b9-1715-6902-be02-000000002b00}440C:\Windows\UUS\Packages\Preview\amd64\MoNotificationUx.exe1450.2506.28022.0Notifications host processMicrosoft® Windows® Operating SystemMicrosoft CorporationMoNotificationUx.exeC:\WINDOWS\uus\packages\preview\AMD64\MoNotificationUx.exe /ClearActiveNotifications /CV x2sHkZhQTUqT3y32.1.0.0C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=D97428A8D4622A2B55C29AAF093A4587,SHA256=84913C18E04A4BFD84A0EC98FE5D636607C5A0EC9C320602FC53B45BB06E3C1B,IMPHASH=B582311B9D89BE4D0BBCB08118245AB0{8223a6b9-16aa-6902-ab02-000000002b00}11008C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe"C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespacesNT AUTHORITY\SYSTEM 11241100x800000000000000012183Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:37.646{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{BF144E4F-A494-4E6C-B6B1-AA08D46C5D47}\ssshim.dll2025-10-29 13:31:37.646NT AUTHORITY\SYSTEM 11241100x800000000000000012184Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.019{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\UpdateCompression.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012185Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.027{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\featurestaging.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012186Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.027{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\updatedeploy.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012187Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.033{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\AppxDeviceInventory.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012188Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.043{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\TurboStack.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012189Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.043{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\UAOneSettings.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012190Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.059{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\wcp.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012191Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.090{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\MsixPackageProvisioner.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012192Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.090{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\dpx.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012193Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.106{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\WinREAgent.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012194Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.106{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\ReserveManager.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012195Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.106{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\Mitigation.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 11241100x800000000000000012196Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:38.122{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SoftwareDistribution\Download\bd14d107061d4dedbfb9bbde796b7ad3\Metadata\UpdateAgent.dll2025-10-11 21:42:08.000NT AUTHORITY\SYSTEM 13241300x800000000000000012197Microsoft-Windows-Sysmon/Operationalsoc101win11Tamper-WinlogonSetValue2025-10-29 13:31:40.216{8223a6b9-16ac-6902-b202-000000002b00}4072C:\WINDOWS\servicing\TrustedInstaller.exeHKLM\System\CurrentControlSet\Control\Winlogon\Notifications\Components\TrustedInstaller\EventsCreateSessionNT AUTHORITY\SYSTEM 11241100x800000000000000012198Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:42.592{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{97FF2C68-D593-4A40-BA77-A4EEFF9942B6}\ssshim.dll2025-10-29 13:31:42.592NT AUTHORITY\SYSTEM 13241300x800000000000000012199Microsoft-Windows-Sysmon/Operationalsoc101win11Tamper-WinlogonSetValue2025-10-29 13:31:46.961{8223a6b9-16ac-6902-b202-000000002b00}4072C:\WINDOWS\servicing\TrustedInstaller.exeHKLM\System\CurrentControlSet\Control\Winlogon\Notifications\Components\TrustedInstaller\Events(Empty)NT AUTHORITY\SYSTEM 11241100x800000000000000012200Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:48.509{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{84485E27-8CF1-4406-A708-6007B4AFA951}\ssshim.dll2025-10-29 13:31:48.507NT AUTHORITY\SYSTEM 11241100x800000000000000012201Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:49.639{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\PackagedCom\CrossDevice.Contracts.Settings.ProxyStub.dll2025-10-29 13:31:49.639NT AUTHORITY\SYSTEM 11241100x800000000000000012202Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:49.643{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\PackagedCom\CrossDevice.Contracts.Streaming.ProxyStub.dll2025-10-29 13:31:49.643NT AUTHORITY\SYSTEM 11241100x800000000000000012203Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:49.646{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\PackagedCom\CrossDevice.Contracts.Share.ProxyStub.dll2025-10-29 13:31:49.644NT AUTHORITY\SYSTEM 11241100x800000000000000012204Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:49.648{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\PackagedCom\CrossDevice.Core.ProxyStub.dll2025-10-29 13:31:49.648NT AUTHORITY\SYSTEM 11241100x800000000000000012205Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:49.653{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\PackagedCom\CrossDevice.Contracts.Files.ProxyStub.dll2025-10-29 13:31:49.653NT AUTHORITY\SYSTEM 11241100x800000000000000012206Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:50.023{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{D5946C07-D147-4E49-937A-E135534216FB}\ssshim.dll2025-10-29 13:31:50.023NT AUTHORITY\SYSTEM 11241100x800000000000000012207Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:51.426{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{DB18ECF1-4842-4595-A645-92712E2EEE32}\ssshim.dll2025-10-29 13:31:51.426NT AUTHORITY\SYSTEM 11241100x800000000000000012208Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:52.975{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{98399DD0-F475-4089-9DFC-95BB29F8D424}\ssshim.dll2025-10-29 13:31:52.975NT AUTHORITY\SYSTEM 11241100x800000000000000012209Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:54.310{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{476BCC14-4AF5-4A93-B831-83A872846755}\ssshim.dll2025-10-29 13:31:54.310NT AUTHORITY\SYSTEM 11241100x800000000000000012210Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:55.388{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{FA6FD72C-3DB3-4A1B-A283-727C206AD04D}\ssshim.dll2025-10-29 13:31:55.388NT AUTHORITY\SYSTEM 11241100x800000000000000012211Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.744{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\CoreMessagingXP.dll2025-10-29 13:31:57.744NT AUTHORITY\SYSTEM 11241100x800000000000000012212Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.748{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\dcompi.dll2025-10-29 13:31:57.748NT AUTHORITY\SYSTEM 11241100x800000000000000012213Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:31:57.768{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\DeploymentAgent.exe2025-10-29 13:31:57.768NT AUTHORITY\SYSTEM 11241100x800000000000000012214Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.768{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\dwmcorei.dll2025-10-29 13:31:57.768NT AUTHORITY\SYSTEM 11241100x800000000000000012215Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.770{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\DwmSceneI.dll2025-10-29 13:31:57.770NT AUTHORITY\SYSTEM 11241100x800000000000000012216Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.824{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\marshal.dll2025-10-29 13:31:57.824NT AUTHORITY\SYSTEM 11241100x800000000000000012217Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.826{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.DirectManipulation.dll2025-10-29 13:31:57.826NT AUTHORITY\SYSTEM 11241100x800000000000000012218Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.826{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.Graphics.Display.dll2025-10-29 13:31:57.826NT AUTHORITY\SYSTEM 11241100x800000000000000012219Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.828{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.InputStateManager.dll2025-10-29 13:31:57.828NT AUTHORITY\SYSTEM 11241100x800000000000000012220Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.828{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.Internal.FrameworkUdk.dll2025-10-29 13:31:57.828NT AUTHORITY\SYSTEM 11241100x800000000000000012221Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.828{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.UI.Composition.OSSupport.dll2025-10-29 13:31:57.828NT AUTHORITY\SYSTEM 11241100x800000000000000012222Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.828{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.UI.dll2025-10-29 13:31:57.828NT AUTHORITY\SYSTEM 11241100x800000000000000012223Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.830{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.UI.Input.dll2025-10-29 13:31:57.830NT AUTHORITY\SYSTEM 11241100x800000000000000012224Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.830{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.UI.Windowing.Core.dll2025-10-29 13:31:57.830NT AUTHORITY\SYSTEM 11241100x800000000000000012225Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.830{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.UI.Windowing.dll2025-10-29 13:31:57.830NT AUTHORITY\SYSTEM 11241100x800000000000000012226Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.832{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.UI.Xaml.Controls.dll2025-10-29 13:31:57.832NT AUTHORITY\SYSTEM 11241100x800000000000000012227Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.832{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.ui.xaml.dll2025-10-29 13:31:57.832NT AUTHORITY\SYSTEM 11241100x800000000000000012228Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.834{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.UI.Xaml.Internal.dll2025-10-29 13:31:57.834NT AUTHORITY\SYSTEM 11241100x800000000000000012229Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.845{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.UI.Xaml.Phone.dll2025-10-29 13:31:57.845NT AUTHORITY\SYSTEM 11241100x800000000000000012230Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.859{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.ui.xaml.resources.19h1.dll2025-10-29 13:31:57.847NT AUTHORITY\SYSTEM 11241100x800000000000000012231Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.861{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.ui.xaml.resources.common.dll2025-10-29 13:31:57.859NT AUTHORITY\SYSTEM 11241100x800000000000000012232Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.863{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Resources.dll2025-10-29 13:31:57.863NT AUTHORITY\SYSTEM 11241100x800000000000000012233Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.875{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.dll2025-10-29 13:31:57.875NT AUTHORITY\SYSTEM 11241100x800000000000000012234Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.875{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.Insights.Resource.dll2025-10-29 13:31:57.875NT AUTHORITY\SYSTEM 11241100x800000000000000012235Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.879{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\MRM.dll2025-10-29 13:31:57.879NT AUTHORITY\SYSTEM 11241100x800000000000000012236Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.893{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\PushNotificationsLongRunningTask.ProxyStub.dll2025-10-29 13:31:57.893NT AUTHORITY\SYSTEM 11241100x800000000000000012237Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:31:57.895{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\RestartAgent.exe2025-10-29 13:31:57.895NT AUTHORITY\SYSTEM 11241100x800000000000000012238Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.919{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\WindowsAppRuntime.DeploymentExtensions.OneCore.dll2025-10-29 13:31:57.919NT AUTHORITY\SYSTEM 11241100x800000000000000012239Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.919{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll2025-10-29 13:31:57.919NT AUTHORITY\SYSTEM 11241100x800000000000000012240Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.919{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll2025-10-29 13:31:57.919NT AUTHORITY\SYSTEM 11241100x800000000000000012241Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.921{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\WinUIEdit.dll2025-10-29 13:31:57.921NT AUTHORITY\SYSTEM 11241100x800000000000000012242Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:57.921{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\wuceffectsi.dll2025-10-29 13:31:57.921NT AUTHORITY\SYSTEM 11241100x800000000000000012243Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:58.968{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{08AB403C-5B01-4EA3-8904-13A8D1FFE523}\ssshim.dll2025-10-29 13:31:58.968NT AUTHORITY\SYSTEM 11241100x800000000000000012244Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:31:59.946{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{05A871D0-A3E4-4B8D-9798-A3C0C3E2FD34}\ssshim.dll2025-10-29 13:31:59.946NT AUTHORITY\SYSTEM 154100x800000000000000012245Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:32:05.270{8223a6b9-1755-6902-c002-000000002b00}12080C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exe"C:\WINDOWS\system32\wevtutil.exe" uninstall-manifest "C:\WINDOWS\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\EventLog-Instrumentation.man" /unicode:trueC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-131b-6902-7300-000000002b00}5976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvcNT AUTHORITY\SYSTEM 12241200x800000000000000012246Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:32:05.437{8223a6b9-1755-6902-c002-000000002b00}12080C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/OperationalNT AUTHORITY\SYSTEM 154100x800000000000000012247Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:32:05.464{8223a6b9-1755-6902-c202-000000002b00}7228C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exe"C:\WINDOWS\system32\wevtutil.exe" install-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\EventLog-Instrumentation.man" /resourceFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /messageFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /unicode:trueC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-131b-6902-7300-000000002b00}5976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvcNT AUTHORITY\SYSTEM 13241300x800000000000000012248Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:05.616{8223a6b9-1755-6902-c202-000000002b00}7228C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\OwningPublisher{43833e12-078d-4d7d-8aaf-ae8c8520f18c}NT AUTHORITY\SYSTEM 13241300x800000000000000012249Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:05.616{8223a6b9-1755-6902-c202-000000002b00}7228C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\EnabledDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000012250Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:05.616{8223a6b9-1755-6902-c202-000000002b00}7228C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\IsolationDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000012251Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:05.616{8223a6b9-1755-6902-c202-000000002b00}7228C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\ChannelAccessO:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)NT AUTHORITY\SYSTEM 13241300x800000000000000012252Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:05.616{8223a6b9-1755-6902-c202-000000002b00}7228C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\MaxSizeDWORD (0x00500000)NT AUTHORITY\SYSTEM 13241300x800000000000000012253Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:05.616{8223a6b9-1755-6902-c202-000000002b00}7228C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\MaxSizeUpperDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000012254Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:05.616{8223a6b9-1755-6902-c202-000000002b00}7228C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\TypeDWORD (0x00000001)NT AUTHORITY\SYSTEM 11241100x800000000000000012255Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.652{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\CoreMessagingXP.dll2025-10-29 13:32:06.652NT AUTHORITY\SYSTEM 11241100x800000000000000012256Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.656{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\dcompi.dll2025-10-29 13:32:06.656NT AUTHORITY\SYSTEM 11241100x800000000000000012257Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:32:06.658{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\DeploymentAgent.exe2025-10-29 13:32:06.658NT AUTHORITY\SYSTEM 11241100x800000000000000012258Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.658{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\dwmcorei.dll2025-10-29 13:32:06.658NT AUTHORITY\SYSTEM 11241100x800000000000000012259Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.658{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\DwmSceneI.dll2025-10-29 13:32:06.658NT AUTHORITY\SYSTEM 11241100x800000000000000012260Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.710{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\marshal.dll2025-10-29 13:32:06.710NT AUTHORITY\SYSTEM 11241100x800000000000000012261Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.710{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.DirectManipulation.dll2025-10-29 13:32:06.710NT AUTHORITY\SYSTEM 11241100x800000000000000012262Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.712{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.Graphics.Display.dll2025-10-29 13:32:06.712NT AUTHORITY\SYSTEM 11241100x800000000000000012263Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.712{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.InputStateManager.dll2025-10-29 13:32:06.712NT AUTHORITY\SYSTEM 11241100x800000000000000012264Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.714{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.Internal.FrameworkUdk.dll2025-10-29 13:32:06.712NT AUTHORITY\SYSTEM 11241100x800000000000000012265Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.714{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.UI.Composition.OSSupport.dll2025-10-29 13:32:06.714NT AUTHORITY\SYSTEM 11241100x800000000000000012266Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.714{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.UI.dll2025-10-29 13:32:06.714NT AUTHORITY\SYSTEM 11241100x800000000000000012267Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.716{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.UI.Input.dll2025-10-29 13:32:06.714NT AUTHORITY\SYSTEM 11241100x800000000000000012268Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.716{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.UI.Windowing.Core.dll2025-10-29 13:32:06.716NT AUTHORITY\SYSTEM 11241100x800000000000000012269Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.716{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.UI.Windowing.dll2025-10-29 13:32:06.716NT AUTHORITY\SYSTEM 11241100x800000000000000012270Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.716{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.Controls.dll2025-10-29 13:32:06.716NT AUTHORITY\SYSTEM 11241100x800000000000000012271Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.718{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.ui.xaml.dll2025-10-29 13:32:06.718NT AUTHORITY\SYSTEM 11241100x800000000000000012272Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.718{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.Internal.dll2025-10-29 13:32:06.718NT AUTHORITY\SYSTEM 11241100x800000000000000012273Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.718{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.Phone.dll2025-10-29 13:32:06.718NT AUTHORITY\SYSTEM 11241100x800000000000000012274Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.718{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.ui.xaml.resources.19h1.dll2025-10-29 13:32:06.718NT AUTHORITY\SYSTEM 11241100x800000000000000012275Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.720{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.ui.xaml.resources.common.dll2025-10-29 13:32:06.720NT AUTHORITY\SYSTEM 11241100x800000000000000012276Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.720{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Resources.dll2025-10-29 13:32:06.720NT AUTHORITY\SYSTEM 11241100x800000000000000012277Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.720{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.dll2025-10-29 13:32:06.720NT AUTHORITY\SYSTEM 11241100x800000000000000012278Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.720{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.Insights.Resource.dll2025-10-29 13:32:06.720NT AUTHORITY\SYSTEM 11241100x800000000000000012279Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.724{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\MRM.dll2025-10-29 13:32:06.724NT AUTHORITY\SYSTEM 11241100x800000000000000012280Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.740{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\PushNotificationsLongRunningTask.ProxyStub.dll2025-10-29 13:32:06.740NT AUTHORITY\SYSTEM 11241100x800000000000000012281Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:32:06.742{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\RestartAgent.exe2025-10-29 13:32:06.740NT AUTHORITY\SYSTEM 11241100x800000000000000012282Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.768{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\WindowsAppRuntime.DeploymentExtensions.OneCore.dll2025-10-29 13:32:06.768NT AUTHORITY\SYSTEM 11241100x800000000000000012283Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.768{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll2025-10-29 13:32:06.768NT AUTHORITY\SYSTEM 11241100x800000000000000012284Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.770{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll2025-10-29 13:32:06.768NT AUTHORITY\SYSTEM 11241100x800000000000000012285Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.770{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\WinUIEdit.dll2025-10-29 13:32:06.770NT AUTHORITY\SYSTEM 11241100x800000000000000012286Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:06.770{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\wuceffectsi.dll2025-10-29 13:32:06.770NT AUTHORITY\SYSTEM 11241100x800000000000000012287Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:07.381{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{E171C959-4143-4767-BB4B-8A0509EA2017}\ssshim.dll2025-10-29 13:32:07.381NT AUTHORITY\SYSTEM 11241100x800000000000000012288Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:08.227{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{95B408D0-8CCE-4F72-B044-5A0621618041}\ssshim.dll2025-10-29 13:32:08.227NT AUTHORITY\SYSTEM 13241300x800000000000000012289Microsoft-Windows-Sysmon/Operationalsoc101win11T1060,RunKeySetValue2025-10-29 13:32:15.436{8223a6b9-14f8-6902-ef01-000000002b00}8788C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.99\Installer\setup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.99\Installer\setup.exe" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logonNT AUTHORITY\SYSTEM 154100x800000000000000012290Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:32:15.531{8223a6b9-175f-6902-c402-000000002b00}1916C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exe"C:\WINDOWS\system32\wevtutil.exe" uninstall-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x86__8wekyb3d8bbwe\EventLog-Instrumentation.man" /unicode:trueC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-131b-6902-7300-000000002b00}5976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvcNT AUTHORITY\SYSTEM 12241200x800000000000000012291Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:32:15.624{8223a6b9-175f-6902-c402-000000002b00}1916C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/OperationalNT AUTHORITY\SYSTEM 154100x800000000000000012292Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:32:15.651{8223a6b9-175f-6902-c602-000000002b00}9940C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exe"C:\WINDOWS\system32\wevtutil.exe" install-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\EventLog-Instrumentation.man" /resourceFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /messageFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /unicode:trueC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-131b-6902-7300-000000002b00}5976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvcNT AUTHORITY\SYSTEM 13241300x800000000000000012293Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:15.753{8223a6b9-175f-6902-c602-000000002b00}9940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\OwningPublisher{43833e12-078d-4d7d-8aaf-ae8c8520f18c}NT AUTHORITY\SYSTEM 13241300x800000000000000012294Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:15.753{8223a6b9-175f-6902-c602-000000002b00}9940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\EnabledDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000012295Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:15.753{8223a6b9-175f-6902-c602-000000002b00}9940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\IsolationDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000012296Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:15.753{8223a6b9-175f-6902-c602-000000002b00}9940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\ChannelAccessO:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)NT AUTHORITY\SYSTEM 13241300x800000000000000012297Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:15.753{8223a6b9-175f-6902-c602-000000002b00}9940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\MaxSizeDWORD (0x00500000)NT AUTHORITY\SYSTEM 13241300x800000000000000012298Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:15.753{8223a6b9-175f-6902-c602-000000002b00}9940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\MaxSizeUpperDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000012299Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:32:15.753{8223a6b9-175f-6902-c602-000000002b00}9940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\TypeDWORD (0x00000001)NT AUTHORITY\SYSTEM 11241100x800000000000000012300Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.396{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\CoreMessagingXP.dll2025-10-29 13:32:16.396NT AUTHORITY\SYSTEM 11241100x800000000000000012301Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.400{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\dcompi.dll2025-10-29 13:32:16.400NT AUTHORITY\SYSTEM 11241100x800000000000000012302Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:32:16.402{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\DeploymentAgent.exe2025-10-29 13:32:16.402NT AUTHORITY\SYSTEM 11241100x800000000000000012303Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.402{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\DirectML.dll2025-10-29 13:32:16.402NT AUTHORITY\SYSTEM 11241100x800000000000000012304Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.402{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\dwmcorei.dll2025-10-29 13:32:16.402NT AUTHORITY\SYSTEM 11241100x800000000000000012305Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.404{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\DwmSceneI.dll2025-10-29 13:32:16.402NT AUTHORITY\SYSTEM 11241100x800000000000000012306Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.404{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\DWriteCore.dll2025-10-29 13:32:16.404NT AUTHORITY\SYSTEM 11241100x800000000000000012307Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.446{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\marshal.dll2025-10-29 13:32:16.446NT AUTHORITY\SYSTEM 11241100x800000000000000012308Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.450{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.DirectManipulation.dll2025-10-29 13:32:16.448NT AUTHORITY\SYSTEM 11241100x800000000000000012309Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.450{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Graphics.Display.dll2025-10-29 13:32:16.450NT AUTHORITY\SYSTEM 11241100x800000000000000012310Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.450{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Graphics.Imaging.dll2025-10-29 13:32:16.450NT AUTHORITY\SYSTEM 11241100x800000000000000012311Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.458{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.InputStateManager.dll2025-10-29 13:32:16.456NT AUTHORITY\SYSTEM 11241100x800000000000000012312Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.458{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Internal.FrameworkUdk.dll2025-10-29 13:32:16.458NT AUTHORITY\SYSTEM 11241100x800000000000000012313Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.458{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.UI.Composition.OSSupport.dll2025-10-29 13:32:16.458NT AUTHORITY\SYSTEM 11241100x800000000000000012314Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.458{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.UI.Designer.dll2025-10-29 13:32:16.458NT AUTHORITY\SYSTEM 11241100x800000000000000012315Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.460{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.UI.dll2025-10-29 13:32:16.458NT AUTHORITY\SYSTEM 11241100x800000000000000012316Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.460{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.UI.Input.dll2025-10-29 13:32:16.460NT AUTHORITY\SYSTEM 11241100x800000000000000012317Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.462{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.UI.Windowing.Core.dll2025-10-29 13:32:16.460NT AUTHORITY\SYSTEM 11241100x800000000000000012318Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.462{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.UI.Windowing.dll2025-10-29 13:32:16.462NT AUTHORITY\SYSTEM 11241100x800000000000000012319Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.462{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.Controls.dll2025-10-29 13:32:16.462NT AUTHORITY\SYSTEM 11241100x800000000000000012320Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.464{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.ui.xaml.dll2025-10-29 13:32:16.462NT AUTHORITY\SYSTEM 11241100x800000000000000012321Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.464{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.Internal.dll2025-10-29 13:32:16.464NT AUTHORITY\SYSTEM 11241100x800000000000000012322Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.464{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.Phone.dll2025-10-29 13:32:16.464NT AUTHORITY\SYSTEM 11241100x800000000000000012323Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.464{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.ui.xaml.resources.19h1.dll2025-10-29 13:32:16.464NT AUTHORITY\SYSTEM 11241100x800000000000000012324Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.464{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.ui.xaml.resources.common.dll2025-10-29 13:32:16.464NT AUTHORITY\SYSTEM 11241100x800000000000000012325Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.466{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Windows.AI.ContentSafety.dll2025-10-29 13:32:16.466NT AUTHORITY\SYSTEM 11241100x800000000000000012326Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.470{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Windows.AI.Imaging.dll2025-10-29 13:32:16.470NT AUTHORITY\SYSTEM 11241100x800000000000000012327Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.470{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Windows.AI.MachineLearning.dll2025-10-29 13:32:16.470NT AUTHORITY\SYSTEM 11241100x800000000000000012328Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.470{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Windows.AI.Text.dll2025-10-29 13:32:16.470NT AUTHORITY\SYSTEM 11241100x800000000000000012329Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.474{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Resources.dll2025-10-29 13:32:16.474NT AUTHORITY\SYSTEM 11241100x800000000000000012330Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.487{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Widgets.dll2025-10-29 13:32:16.487NT AUTHORITY\SYSTEM 11241100x800000000000000012331Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.487{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Workloads.dll2025-10-29 13:32:16.487NT AUTHORITY\SYSTEM 11241100x800000000000000012332Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.489{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Workloads.Resources.dll2025-10-29 13:32:16.489NT AUTHORITY\SYSTEM 11241100x800000000000000012333Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.489{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Workloads.Resources_ec.dll2025-10-29 13:32:16.489NT AUTHORITY\SYSTEM 11241100x800000000000000012334Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.489{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.dll2025-10-29 13:32:16.489NT AUTHORITY\SYSTEM 11241100x800000000000000012335Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.489{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.Insights.Resource.dll2025-10-29 13:32:16.489NT AUTHORITY\SYSTEM 11241100x800000000000000012336Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.495{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\MRM.dll2025-10-29 13:32:16.495NT AUTHORITY\SYSTEM 11241100x800000000000000012337Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.519{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\NpuDetect\NPUDetect.dll2025-10-29 13:32:16.519NT AUTHORITY\SYSTEM 11241100x800000000000000012338Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.519{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\onnxruntime.dll2025-10-29 13:32:16.519NT AUTHORITY\SYSTEM 11241100x800000000000000012339Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.521{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\onnxruntime_providers_shared.dll2025-10-29 13:32:16.519NT AUTHORITY\SYSTEM 11241100x800000000000000012340Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.529{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\PushNotificationsLongRunningTask.ProxyStub.dll2025-10-29 13:32:16.527NT AUTHORITY\SYSTEM 11241100x800000000000000012341Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:32:16.531{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\RestartAgent.exe2025-10-29 13:32:16.531NT AUTHORITY\SYSTEM 11241100x800000000000000012342Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.533{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\SessionHandleIPCProxyStub.dll2025-10-29 13:32:16.533NT AUTHORITY\SYSTEM 11241100x800000000000000012343Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.555{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\WindowsAppRuntime.DeploymentExtensions.OneCore.dll2025-10-29 13:32:16.555NT AUTHORITY\SYSTEM 11241100x800000000000000012344Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.557{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll2025-10-29 13:32:16.557NT AUTHORITY\SYSTEM 11241100x800000000000000012345Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.557{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll2025-10-29 13:32:16.557NT AUTHORITY\SYSTEM 11241100x800000000000000012346Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.557{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\WinUIEdit.dll2025-10-29 13:32:16.557NT AUTHORITY\SYSTEM 11241100x800000000000000012347Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:32:16.577{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\wuceffectsi.dll2025-10-29 13:32:16.577NT AUTHORITY\SYSTEM 154100x800000000000000012348Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:32:58.133{8223a6b9-178a-6902-c802-000000002b00}960C:\Windows\UUS\Packages\Preview\amd64\wuaucltcore.exe1407.2506.11012.0Windows UpdateMicrosoft® Windows® Operating SystemMicrosoft Corporationwuaucltcore.exe"C:\WINDOWS\uus\packages\preview\AMD64\wuaucltcore.exe" /DeploymentHandlerFullPath \\?\C:\Windows\UUS\Packages\Preview\AMD64\UpdateDeploy.dll /ClassId 7fea9080-e2ae-4f64-a72f-f8b2d77269fc /RunHandlerComServerC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=EA98A3ECEF7902605B361FC16D3D8081,SHA256=9C685412986F3939E7A84E62B09E319F4FA5B5C2B7006DE3441F6D4BB0CAC02D,IMPHASH=5FB5459A8931EA77DFAA79FC37CD9756{8223a6b9-1317-6902-3f00-000000002b00}3008C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauservNT AUTHORITY\SYSTEM 154100x800000000000000012349Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:33:00.003{8223a6b9-178c-6902-ca02-000000002b00}904C:\Windows\UUS\Packages\Preview\amd64\MoNotificationUx.exe1450.2506.28022.0Notifications host processMicrosoft® Windows® Operating SystemMicrosoft CorporationMoNotificationUx.exeC:\WINDOWS\uus\packages\preview\AMD64\MoNotificationUx.exe /ClearActiveNotifications /CV x2sHkZhQTUqT3y32.1.0.0C:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=D97428A8D4622A2B55C29AAF093A4587,SHA256=84913C18E04A4BFD84A0EC98FE5D636607C5A0EC9C320602FC53B45BB06E3C1B,IMPHASH=B582311B9D89BE4D0BBCB08118245AB0{8223a6b9-16aa-6902-ab02-000000002b00}11008C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe"C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespacesNT AUTHORITY\SYSTEM 11241100x800000000000000012350Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:33:17.511{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{B12FCDAD-5425-405F-AF6B-C7921DF04044}\ssshim.dll2025-10-29 13:33:17.511NT AUTHORITY\SYSTEM 11241100x800000000000000012351Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:33:18.331{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{1FEC6F74-5D5D-4450-A1C9-705BE2C81FCD}\ssshim.dll2025-10-29 13:33:18.331NT AUTHORITY\SYSTEM 11241100x800000000000000012352Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:33:19.133{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{DFEE3ABB-3494-42D5-9201-A104717503B2}\ssshim.dll2025-10-29 13:33:19.133NT AUTHORITY\SYSTEM 154100x800000000000000012353Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:33:56.037{8223a6b9-17c4-6902-cb02-000000002b00}11260C:\Windows\System32\backgroundTaskHost.exe10.0.26100.1 (WinBuild.160101.0800)Background Task HostMicrosoft® Windows® Operating SystemMicrosoft CorporationbackgroundTaskHost.exe"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXapskvk16gk8da8kch5g4qxh42vxccved.mcaC:\Program Files\WindowsApps\Microsoft.YourPhone_1.25082.136.0_x64__8wekyb3d8bbwe\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=8BDE0AE40012BD639FC60E494CC32356,SHA256=B7D2C17E0038945AA4B72AE7A89E54D29B04CCC0FEB62DF5C9B7B67DE43C2530,IMPHASH=DC601E2593053A84A6989DE251407AA7{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x800000000000000012354Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:34:14.688{8223a6b9-17d6-6902-cc02-000000002b00}10216C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exeC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 11241100x800000000000000012355Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:18.368{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{2D1D6F77-0CD5-49BB-A4F4-CAEE98667557}\ssshim.dll2025-10-29 13:34:18.368NT AUTHORITY\SYSTEM 11241100x800000000000000012356Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:19.166{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{EE45737E-0F82-4B11-851B-92383241130D}\ssshim.dll2025-10-29 13:34:19.166NT AUTHORITY\SYSTEM 11241100x800000000000000012357Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:20.053{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{71919C14-3A03-45EF-AB3F-12191854C1CE}\ssshim.dll2025-10-29 13:34:20.053NT AUTHORITY\SYSTEM 11241100x800000000000000012358Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:20.787{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{9A60AB5B-A4C5-4526-BF1B-4D72E5A536F2}\ssshim.dll2025-10-29 13:34:20.787NT AUTHORITY\SYSTEM 154100x800000000000000012359Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:34:30.085{8223a6b9-17e6-6902-cd02-000000002b00}10536C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exe"C:\WINDOWS\system32\wevtutil.exe" uninstall-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.652.1806.0_x64__8wekyb3d8bbwe\EventLog-Instrumentation.man" /unicode:trueC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-131b-6902-7300-000000002b00}5976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvcNT AUTHORITY\SYSTEM 12241200x800000000000000012360Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:34:30.236{8223a6b9-17e6-6902-cd02-000000002b00}10536C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/OperationalNT AUTHORITY\SYSTEM 154100x800000000000000012361Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:34:30.259{8223a6b9-17e6-6902-cf02-000000002b00}3940C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exe"C:\WINDOWS\system32\wevtutil.exe" install-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\EventLog-Instrumentation.man" /resourceFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /messageFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /unicode:trueC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-131b-6902-7300-000000002b00}5976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvcNT AUTHORITY\SYSTEM 13241300x800000000000000012362Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:30.379{8223a6b9-17e6-6902-cf02-000000002b00}3940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\OwningPublisher{43833e12-078d-4d7d-8aaf-ae8c8520f18c}NT AUTHORITY\SYSTEM 13241300x800000000000000012363Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:30.379{8223a6b9-17e6-6902-cf02-000000002b00}3940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\EnabledDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000012364Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:30.379{8223a6b9-17e6-6902-cf02-000000002b00}3940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\IsolationDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000012365Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:30.379{8223a6b9-17e6-6902-cf02-000000002b00}3940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\ChannelAccessO:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)NT AUTHORITY\SYSTEM 13241300x800000000000000012366Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:30.379{8223a6b9-17e6-6902-cf02-000000002b00}3940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\MaxSizeDWORD (0x00500000)NT AUTHORITY\SYSTEM 13241300x800000000000000012367Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:30.379{8223a6b9-17e6-6902-cf02-000000002b00}3940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\MaxSizeUpperDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000012368Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:30.379{8223a6b9-17e6-6902-cf02-000000002b00}3940C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\TypeDWORD (0x00000001)NT AUTHORITY\SYSTEM 11241100x800000000000000012369Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.130{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\CoreMessagingXP.dll2025-10-29 13:34:31.130NT AUTHORITY\SYSTEM 11241100x800000000000000012370Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.132{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\dcompi.dll2025-10-29 13:34:31.132NT AUTHORITY\SYSTEM 11241100x800000000000000012371Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:31.134{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\DeploymentAgent.exe2025-10-29 13:34:31.134NT AUTHORITY\SYSTEM 11241100x800000000000000012372Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.136{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\dwmcorei.dll2025-10-29 13:34:31.134NT AUTHORITY\SYSTEM 11241100x800000000000000012373Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.136{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\DwmSceneI.dll2025-10-29 13:34:31.136NT AUTHORITY\SYSTEM 11241100x800000000000000012374Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.136{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\DWriteCore.dll2025-10-29 13:34:31.136NT AUTHORITY\SYSTEM 11241100x800000000000000012375Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.174{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\marshal.dll2025-10-29 13:34:31.174NT AUTHORITY\SYSTEM 11241100x800000000000000012376Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.174{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.DirectManipulation.dll2025-10-29 13:34:31.174NT AUTHORITY\SYSTEM 11241100x800000000000000012377Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.176{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.Graphics.Display.dll2025-10-29 13:34:31.176NT AUTHORITY\SYSTEM 11241100x800000000000000012378Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.176{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.InputStateManager.dll2025-10-29 13:34:31.176NT AUTHORITY\SYSTEM 11241100x800000000000000012379Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.176{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.Internal.FrameworkUdk.dll2025-10-29 13:34:31.176NT AUTHORITY\SYSTEM 11241100x800000000000000012380Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.176{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.UI.Composition.OSSupport.dll2025-10-29 13:34:31.176NT AUTHORITY\SYSTEM 11241100x800000000000000012381Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.192{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.UI.Designer.dll2025-10-29 13:34:31.176NT AUTHORITY\SYSTEM 11241100x800000000000000012382Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.192{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.UI.dll2025-10-29 13:34:31.192NT AUTHORITY\SYSTEM 11241100x800000000000000012383Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.194{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.UI.Input.dll2025-10-29 13:34:31.194NT AUTHORITY\SYSTEM 11241100x800000000000000012384Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.194{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.UI.Windowing.Core.dll2025-10-29 13:34:31.194NT AUTHORITY\SYSTEM 11241100x800000000000000012385Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.194{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.UI.Windowing.dll2025-10-29 13:34:31.194NT AUTHORITY\SYSTEM 11241100x800000000000000012386Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.196{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.UI.Xaml.Controls.dll2025-10-29 13:34:31.196NT AUTHORITY\SYSTEM 11241100x800000000000000012387Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.196{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.ui.xaml.dll2025-10-29 13:34:31.196NT AUTHORITY\SYSTEM 11241100x800000000000000012388Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.196{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.UI.Xaml.Internal.dll2025-10-29 13:34:31.196NT AUTHORITY\SYSTEM 11241100x800000000000000012389Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.196{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.UI.Xaml.Phone.dll2025-10-29 13:34:31.196NT AUTHORITY\SYSTEM 11241100x800000000000000012390Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.196{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.ui.xaml.resources.19h1.dll2025-10-29 13:34:31.196NT AUTHORITY\SYSTEM 11241100x800000000000000012391Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.196{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.ui.xaml.resources.common.dll2025-10-29 13:34:31.196NT AUTHORITY\SYSTEM 11241100x800000000000000012392Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.198{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Resources.dll2025-10-29 13:34:31.198NT AUTHORITY\SYSTEM 11241100x800000000000000012393Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.198{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.Windows.Widgets.dll2025-10-29 13:34:31.198NT AUTHORITY\SYSTEM 11241100x800000000000000012394Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.198{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.dll2025-10-29 13:34:31.198NT AUTHORITY\SYSTEM 11241100x800000000000000012395Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.198{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.Insights.Resource.dll2025-10-29 13:34:31.198NT AUTHORITY\SYSTEM 11241100x800000000000000012396Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.202{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\MRM.dll2025-10-29 13:34:31.202NT AUTHORITY\SYSTEM 11241100x800000000000000012397Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.212{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\PushNotificationsLongRunningTask.ProxyStub.dll2025-10-29 13:34:31.212NT AUTHORITY\SYSTEM 11241100x800000000000000012398Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:31.214{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\RestartAgent.exe2025-10-29 13:34:31.214NT AUTHORITY\SYSTEM 11241100x800000000000000012399Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.236{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\WindowsAppRuntime.DeploymentExtensions.OneCore.dll2025-10-29 13:34:31.236NT AUTHORITY\SYSTEM 11241100x800000000000000012400Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.236{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll2025-10-29 13:34:31.236NT AUTHORITY\SYSTEM 11241100x800000000000000012401Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.236{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll2025-10-29 13:34:31.236NT AUTHORITY\SYSTEM 11241100x800000000000000012402Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.236{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\WinUIEdit.dll2025-10-29 13:34:31.236NT AUTHORITY\SYSTEM 11241100x800000000000000012403Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.238{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\wuceffectsi.dll2025-10-29 13:34:31.236NT AUTHORITY\SYSTEM 11241100x800000000000000012404Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:31.363{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{82CDA888-A56D-40B5-B03A-A1718C639340}\ssshim.dll2025-10-29 13:34:31.363NT AUTHORITY\SYSTEM 11241100x800000000000000012405Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:32.063{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{C93C69FB-0D53-4705-BF72-9C9900CB54BF}\ssshim.dll2025-10-29 13:34:32.063NT AUTHORITY\SYSTEM 11241100x800000000000000012406Microsoft-Windows-Sysmon/Operationalsoc101win11T10532025-10-29 13:34:34.592{8223a6b9-1316-6902-1c00-000000002b00}1588C:\WINDOWS\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification2024-11-11 18:43:45.093NT AUTHORITY\SYSTEM 154100x800000000000000012407Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:34:34.584{8223a6b9-17ea-6902-d102-000000002b00}7480C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpCmdRun.exe4.18.25090.3009 (eca5bedb954af928bf12cba51015d5b3e0195e2e)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivilegesC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4A97718C3D21C275DF1DF85BF7F758B7,SHA256=3FD551FC5995EC5985573B2F5DFAEF40316685F75AC3D9FB0EDC97A31AE7C3EE,IMPHASH=7902D3C560F5DB06F26CF34464340E07{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 11241100x800000000000000012408Microsoft-Windows-Sysmon/Operationalsoc101win11T10532025-10-29 13:34:34.627{8223a6b9-1316-6902-1c00-000000002b00}1588C:\WINDOWS\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance2024-11-11 18:43:44.932NT AUTHORITY\SYSTEM 11241100x800000000000000012409Microsoft-Windows-Sysmon/Operationalsoc101win11T10532025-10-29 13:34:34.665{8223a6b9-1316-6902-1c00-000000002b00}1588C:\WINDOWS\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup2024-11-11 18:43:45.161NT AUTHORITY\SYSTEM 11241100x800000000000000012410Microsoft-Windows-Sysmon/Operationalsoc101win11T10532025-10-29 13:34:34.709{8223a6b9-1316-6902-1c00-000000002b00}1588C:\WINDOWS\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan2024-11-11 18:43:45.246NT AUTHORITY\SYSTEM 154100x800000000000000012411Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:34:34.783{8223a6b9-17ea-6902-d302-000000002b00}9852C:\Windows\System32\smartscreen.exe10.0.26100.4652 (WinBuild.160101.0800)Windows Defender SmartScreenMicrosoft® Windows® Operating SystemMicrosoft Corporationsmartscreen.exeC:\Windows\System32\smartscreen.exe -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=4B9FD8FEFBA636B66F81E0CDBD12B3DA,SHA256=86530447A3E2B502FE2AC164434B13137E5505A86743A96A091EC18A9377D9D9,IMPHASH=C84171DF6E7F087EA4E625CCCE2AB167{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 154100x800000000000000012412Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:34:34.818{8223a6b9-17ea-6902-d402-000000002b00}1712C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpCmdRun.exe4.18.25090.3009 (eca5bedb954af928bf12cba51015d5b3e0195e2e)Microsoft Malware Protection Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft CorporationMpCmdRun.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdateC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=4A97718C3D21C275DF1DF85BF7F758B7,SHA256=3FD551FC5995EC5985573B2F5DFAEF40316685F75AC3D9FB0EDC97A31AE7C3EE,IMPHASH=7902D3C560F5DB06F26CF34464340E07{8223a6b9-158a-6902-3a02-000000002b00}2888C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"NT AUTHORITY\SYSTEM 13241300x800000000000000012413Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PathSetValue2025-10-29 13:34:35.212{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpcmdrun.exe|a385d87b283bb235\LowerCaseLongPathc:\programdata\microsoft\windows defender\platform\4.18.25090.3009-0\mpcmdrun.exeNT AUTHORITY\SYSTEM 13241300x800000000000000012414Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-PubSetValue2025-10-29 13:34:35.212{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpcmdrun.exe|a385d87b283bb235\Publishermicrosoft corporationNT AUTHORITY\SYSTEM 13241300x800000000000000012415Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-CompileTimeClaimSetValue2025-10-29 13:34:35.212{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpcmdrun.exe|a385d87b283bb235\LinkDate02/01/2054 15:06:23NT AUTHORITY\SYSTEM 13241300x800000000000000012416Microsoft-Windows-Sysmon/Operationalsoc101win11InvDB-VerSetValue2025-10-29 13:34:35.212{8223a6b9-1318-6902-4e00-000000002b00}3832C:\WINDOWS\System32\svchost.exe\REGISTRY\A\{596e4c15-49ea-77ee-590a-ffd439bb98db}\Root\InventoryApplicationFile\mpcmdrun.exe|a385d87b283bb235\BinProductVersion4.18.25090.3009NT AUTHORITY\SYSTEM 154100x800000000000000012417Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:34:36.448{8223a6b9-17ec-6902-d602-000000002b00}11000C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exe"C:\WINDOWS\system32\wevtutil.exe" uninstall-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x64__8wekyb3d8bbwe\EventLog-Instrumentation.man" /unicode:trueC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-131b-6902-7300-000000002b00}5976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvcNT AUTHORITY\SYSTEM 12241200x800000000000000012418Microsoft-Windows-Sysmon/Operationalsoc101win11-DeleteKey2025-10-29 13:34:36.585{8223a6b9-17ec-6902-d602-000000002b00}11000C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/OperationalNT AUTHORITY\SYSTEM 154100x800000000000000012419Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:34:36.611{8223a6b9-17ec-6902-d802-000000002b00}6004C:\Windows\System32\wevtutil.exe10.0.26100.1150 (WinBuild.160101.0800)Windows Event Log UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exe"C:\WINDOWS\system32\wevtutil.exe" install-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\EventLog-Instrumentation.man" /resourceFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /messageFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.642.119.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /unicode:trueC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=AF54D4FA49CD679D47064D30BD1B7641,SHA256=0EA582D5A4EB48096B40C2F7A102E465DAEA69C816C8FAEA481B68D8FD0929D5,IMPHASH=9D0B0164498DEE3DA72DF328E7AE8C0B{8223a6b9-131b-6902-7300-000000002b00}5976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvcNT AUTHORITY\SYSTEM 13241300x800000000000000012420Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:36.740{8223a6b9-17ec-6902-d802-000000002b00}6004C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\OwningPublisher{43833e12-078d-4d7d-8aaf-ae8c8520f18c}NT AUTHORITY\SYSTEM 13241300x800000000000000012421Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:36.740{8223a6b9-17ec-6902-d802-000000002b00}6004C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\EnabledDWORD (0x00000001)NT AUTHORITY\SYSTEM 13241300x800000000000000012422Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:36.740{8223a6b9-17ec-6902-d802-000000002b00}6004C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\IsolationDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000012423Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:36.740{8223a6b9-17ec-6902-d802-000000002b00}6004C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\ChannelAccessO:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)NT AUTHORITY\SYSTEM 13241300x800000000000000012424Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:36.740{8223a6b9-17ec-6902-d802-000000002b00}6004C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\MaxSizeDWORD (0x00500000)NT AUTHORITY\SYSTEM 13241300x800000000000000012425Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:36.740{8223a6b9-17ec-6902-d802-000000002b00}6004C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\MaxSizeUpperDWORD (0x00000000)NT AUTHORITY\SYSTEM 13241300x800000000000000012426Microsoft-Windows-Sysmon/Operationalsoc101win11-SetValue2025-10-29 13:34:36.740{8223a6b9-17ec-6902-d802-000000002b00}6004C:\WINDOWS\system32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeployment-Server/Operational\TypeDWORD (0x00000001)NT AUTHORITY\SYSTEM 11241100x800000000000000012427Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:38.128{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{936C537A-B03F-4BE5-8C32-E3B8237CA82F}\ssshim.dll2025-10-29 13:34:38.128NT AUTHORITY\SYSTEM 11241100x800000000000000012428Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:39.046{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{4925E40E-A4EF-4C25-82DD-0C296B926DD2}\ssshim.dll2025-10-29 13:34:39.046NT AUTHORITY\SYSTEM 11241100x800000000000000012429Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:39.992{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{DD1EC8FF-3F4B-4800-8FC6-6AA9592E3D99}\ssshim.dll2025-10-29 13:34:39.992NT AUTHORITY\SYSTEM 11241100x800000000000000012430Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:40.635{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\elevate-shim.exe2025-10-29 13:34:40.635NT AUTHORITY\SYSTEM 11241100x800000000000000012431Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:40.637{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Control.dll2025-10-29 13:34:40.635NT AUTHORITY\SYSTEM 11241100x800000000000000012432Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:40.637{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Editor.dll2025-10-29 13:34:40.637NT AUTHORITY\SYSTEM 11241100x800000000000000012433Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:40.637{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Model.dll2025-10-29 13:34:40.637NT AUTHORITY\SYSTEM 11241100x800000000000000012434Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:40.639{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.UI.dll2025-10-29 13:34:40.639NT AUTHORITY\SYSTEM 11241100x800000000000000012435Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:40.639{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.UI.Markdown.dll2025-10-29 13:34:40.639NT AUTHORITY\SYSTEM 11241100x800000000000000012436Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:40.641{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe2025-10-29 13:34:40.639NT AUTHORITY\SYSTEM 11241100x800000000000000012437Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:40.641{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsoleProxy.dll2025-10-29 13:34:40.641NT AUTHORITY\SYSTEM 11241100x800000000000000012438Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:40.641{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalApp.dll2025-10-29 13:34:40.641NT AUTHORITY\SYSTEM 11241100x800000000000000012439Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:40.641{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe2025-10-29 13:34:40.641NT AUTHORITY\SYSTEM 11241100x800000000000000012440Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:40.643{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalConnection.dll2025-10-29 13:34:40.643NT AUTHORITY\SYSTEM 11241100x800000000000000012441Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:40.643{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalThemeHelpers.dll2025-10-29 13:34:40.643NT AUTHORITY\SYSTEM 11241100x800000000000000012442Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:40.643{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe2025-10-29 13:34:40.643NT AUTHORITY\SYSTEM 11241100x800000000000000012443Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:40.643{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminalShellExt.dll2025-10-29 13:34:40.643NT AUTHORITY\SYSTEM 11241100x800000000000000012444Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:40.645{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\wt.exe2025-10-29 13:34:40.645NT AUTHORITY\SYSTEM 11241100x800000000000000012445Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:41.131{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{8F51BF0B-CE6C-4007-ACF4-30C14322010D}\ssshim.dll2025-10-29 13:34:41.131NT AUTHORITY\SYSTEM 11241100x800000000000000012446Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:41.906{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{C68C3183-87AE-4036-9B4E-86CAE8F51D7D}\ssshim.dll2025-10-29 13:34:41.906NT AUTHORITY\SYSTEM 11241100x800000000000000012447Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:45.953{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll2025-10-29 13:34:45.953NT AUTHORITY\SYSTEM 11241100x800000000000000012448Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:47.353{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{32B703A6-C377-4543-90FE-0FED0BD26B48}\ssshim.dll2025-10-29 13:34:47.351NT AUTHORITY\SYSTEM 11241100x800000000000000012449Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:47.554{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Users\Administrator\AppData\Local\Microsoft\WindowsApps\wt.exe2025-09-03 13:55:18.831NT AUTHORITY\SYSTEM 11241100x800000000000000012450Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:47.556{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Users\Administrator\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe2025-10-29 13:34:47.554NT AUTHORITY\SYSTEM 154100x800000000000000012451Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:34:47.611{8223a6b9-17f7-6902-da02-000000002b00}10836C:\Windows\System32\rundll32.exe10.0.26100.4202 (WinBuild.160101.0800)Windows host process (Rundll32)Microsoft® Windows® Operating SystemMicrosoft CorporationRUNDLL32.EXEC:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\AppXDeploymentExtensions.OneCore.dll,ShellRefreshC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=0257F12B35D1FECB1614585D821346B7,SHA256=7FF8A874903C06C2981F16EF26D1FA2A77B337849A601F6FE4B687FBB0FC15E8,IMPHASH=3DB48F7E208E17408E177BD8B816560A{8223a6b9-131b-6902-7300-000000002b00}5976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvcNT AUTHORITY\SYSTEM 11241100x800000000000000012452Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:48.461{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{39414D50-FD46-4ABC-AA6C-BA1F18B3EEB4}\ssshim.dll2025-10-29 13:34:48.461NT AUTHORITY\SYSTEM 11241100x800000000000000012453Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:49.269{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{32B8A7C2-14AE-4B5A-933A-8B174FEF1725}\ssshim.dll2025-10-29 13:34:49.269NT AUTHORITY\SYSTEM 11241100x800000000000000012454Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:50.516{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{D249AA43-9635-47E9-B61B-0DE57A4E48BE}\ssshim.dll2025-10-29 13:34:50.516NT AUTHORITY\SYSTEM 11241100x800000000000000012455Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:51.346{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{C223D956-31DD-4C7A-A213-C51A0E6CEC0E}\ssshim.dll2025-10-29 13:34:51.346NT AUTHORITY\SYSTEM 11241100x800000000000000012456Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.769{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\AdaptiveCards.ObjectModel.WinUI3.dll2025-10-29 13:34:52.769NT AUTHORITY\SYSTEM 11241100x800000000000000012457Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.769{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\AdaptiveCards.Rendering.WinUI3.dll2025-10-29 13:34:52.769NT AUTHORITY\SYSTEM 11241100x800000000000000012458Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.771{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\Dashboard\Microsoft.Windows.Widgets.dll2025-10-29 13:34:52.771NT AUTHORITY\SYSTEM 11241100x800000000000000012459Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.814{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\Dashboard\WebView2Loader.dll2025-10-29 13:34:52.814NT AUTHORITY\SYSTEM 11241100x800000000000000012460Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.814{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\Dashboard\WidgetPicker.dll2025-10-29 13:34:52.814NT AUTHORITY\SYSTEM 11241100x800000000000000012461Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:52.814{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe2025-10-29 13:34:52.814NT AUTHORITY\SYSTEM 11241100x800000000000000012462Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.814{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\Dashboard\wv2winrt.dll2025-10-29 13:34:52.814NT AUTHORITY\SYSTEM 11241100x800000000000000012463Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.814{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\DynamicLottieWinUI3.dll2025-10-29 13:34:52.814NT AUTHORITY\SYSTEM 11241100x800000000000000012464Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.816{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\Microsoft.Windows.Widgets.dll2025-10-29 13:34:52.816NT AUTHORITY\SYSTEM 11241100x800000000000000012465Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.816{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\TemplateExpander.dll2025-10-29 13:34:52.816NT AUTHORITY\SYSTEM 11241100x800000000000000012466Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:52.816{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\WidgetBoard.exe2025-10-29 13:34:52.816NT AUTHORITY\SYSTEM 11241100x800000000000000012467Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.816{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\WidgetBoardView.dll2025-10-29 13:34:52.816NT AUTHORITY\SYSTEM 11241100x800000000000000012468Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.816{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\Widgets.dll2025-10-29 13:34:52.816NT AUTHORITY\SYSTEM 11241100x800000000000000012469Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:52.818{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.28301.40.0_x64__cw5n1h2txyewy\WidgetsWin2DWinUI3\Microsoft.Graphics.Canvas.dll2025-10-29 13:34:52.818NT AUTHORITY\SYSTEM 11241100x800000000000000012470Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:53.530{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{BF48B839-3C4F-4265-AD6A-4A493A53D893}\ssshim.dll2025-10-29 13:34:53.530NT AUTHORITY\SYSTEM 11241100x800000000000000012471Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:54.429{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{3E286826-CCFE-4B86-9465-DAE0AC749624}\ssshim.dll2025-10-29 13:34:54.429NT AUTHORITY\SYSTEM 11241100x800000000000000012472Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:55.257{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{5AE1E823-128A-4C6A-9830-0EFB5A4781AB}\ssshim.dll2025-10-29 13:34:55.257NT AUTHORITY\SYSTEM 11241100x800000000000000012473Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:56.133{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{72E9B2E2-3977-4EB3-80FF-B77AC5003809}\ssshim.dll2025-10-29 13:34:56.131NT AUTHORITY\SYSTEM 11241100x800000000000000012474Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:56.442{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.BingWeather_4.54.63029.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.dll2025-10-29 13:34:56.442NT AUTHORITY\SYSTEM 11241100x800000000000000012475Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:34:56.442{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.BingWeather_4.54.63029.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe2025-10-29 13:34:56.442NT AUTHORITY\SYSTEM 11241100x800000000000000012476Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:56.444{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.BingWeather_4.54.63029.0_x64__8wekyb3d8bbwe\sqlite3.dll2025-10-29 13:34:56.444NT AUTHORITY\SYSTEM 11241100x800000000000000012477Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:56.444{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.BingWeather_4.54.63029.0_x64__8wekyb3d8bbwe\WinRTAdapter.dll2025-10-29 13:34:56.444NT AUTHORITY\SYSTEM 11241100x800000000000000012478Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:57.729{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{B44142EF-DB9E-4DFE-A084-BADEBD0F2F14}\ssshim.dll2025-10-29 13:34:57.729NT AUTHORITY\SYSTEM 11241100x800000000000000012479Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:34:58.599{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{8951EDB2-3E81-4B5A-9603-134F5ECC04D1}\ssshim.dll2025-10-29 13:34:58.599NT AUTHORITY\SYSTEM 11241100x800000000000000012480Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:04.157{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{805CAD5F-FA3C-4672-96C5-495CEA6C46F9}\ssshim.dll2025-10-29 13:35:04.155NT AUTHORITY\SYSTEM 154100x800000000000000012481Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:35:04.765{8223a6b9-1808-6902-dc02-000000002b00}12276C:\Windows\System32\taskhostw.exe10.0.26100.4768 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe -RegisterDevice -ProtectionStateChanged -FreeNetworkOnlyC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=6A7B0E960579EFB677AEC4233BC8B1A1,SHA256=7F1803B2B12F8DBA1BA945C1CA8482AACAC377984A9ECDA4D5095F1F0AF7E7D9,IMPHASH=2196268E7A2880E3ADC74481297D0C4B{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 154100x800000000000000012482Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:35:04.903{8223a6b9-1808-6902-dd02-000000002b00}5148C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe10.0.27840.1000 (WinBuild.160101.0800)Windows Security Health HostMicrosoft® Windows® Operating SystemMicrosoft CorporationSecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -EmbeddingC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=478FBFDA6A51CF9F0D5BFD50B72DFB08,SHA256=272896B88C6C30DD41E8D44FD54A676FDC6A675BE3F38AAA7434F51B98B822E0,IMPHASH=E8960CAF12CF621B3CA78988264C27F1{8223a6b9-1315-6902-0d00-000000002b00}976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k DcomLaunch -pNT AUTHORITY\SYSTEM 13241300x800000000000000012483Microsoft-Windows-Sysmon/Operationalsoc101win11Suspicious,ImageBeginWithBackslashSetValue2025-10-29 13:35:05.004{8223a6b9-1808-6902-dd02-000000002b00}5148\\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\418A073AA3BC1C75Binary Datasoc101win11\Administrator 11241100x800000000000000012484Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:05.317{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{7BA3F9EB-D522-4A87-B11A-04F5C7AFE71E}\ssshim.dll2025-10-29 13:35:05.317NT AUTHORITY\SYSTEM 154100x800000000000000012485Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:35:05.413{8223a6b9-1809-6902-de02-000000002b00}1716C:\Windows\System32\rundll32.exe10.0.26100.4202 (WinBuild.160101.0800)Windows host process (Rundll32)Microsoft® Windows® Operating SystemMicrosoft CorporationRUNDLL32.EXEC:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\AppXDeploymentExtensions.OneCore.dll,ShellRefreshC:\WINDOWS\system32\soc101win11\Administrator{8223a6b9-1326-6902-9d5a-0b0000000000}0xb5a9d1HighMD5=0257F12B35D1FECB1614585D821346B7,SHA256=7FF8A874903C06C2981F16EF26D1FA2A77B337849A601F6FE4B687FBB0FC15E8,IMPHASH=3DB48F7E208E17408E177BD8B816560A{8223a6b9-131b-6902-7300-000000002b00}5976C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvcNT AUTHORITY\SYSTEM 11241100x800000000000000012486Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:06.761{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{0DE2B147-D300-447F-9D25-44237C142958}\ssshim.dll2025-10-29 13:35:06.759NT AUTHORITY\SYSTEM 11241100x800000000000000012487Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:07.591{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Users\Administrator\AppData\Local\Microsoft\WindowsApps\pbrush.exe2025-09-03 13:55:24.118NT AUTHORITY\SYSTEM 11241100x800000000000000012488Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:07.591{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Users\Administrator\AppData\Local\Microsoft\WindowsApps\Microsoft.Paint_8wekyb3d8bbwe\pbrush.exe2025-09-03 13:55:24.118NT AUTHORITY\SYSTEM 11241100x800000000000000012489Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:07.593{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Users\Administrator\AppData\Local\Microsoft\WindowsApps\mspaint.exe2025-09-03 13:55:24.120NT AUTHORITY\SYSTEM 11241100x800000000000000012490Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:07.593{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Users\Administrator\AppData\Local\Microsoft\WindowsApps\Microsoft.Paint_8wekyb3d8bbwe\mspaint.exe2025-09-03 13:55:24.121NT AUTHORITY\SYSTEM 11241100x800000000000000012491Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:07.968{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{549FBAD1-6C51-4E27-8C20-452FEEDF5BA1}\ssshim.dll2025-10-29 13:35:07.968NT AUTHORITY\SYSTEM 154100x800000000000000012492Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:35:08.241{8223a6b9-180c-6902-e002-000000002b00}8408C:\Windows\System32\wermgr.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Problem ReportingMicrosoft® Windows® Operating SystemMicrosoft CorporationWerMgr"C:\WINDOWS\system32\wermgr.exe" -uploadC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=ABE1D752643419A8252520AABF75C29D,SHA256=1707CB793B8F64B65CA5C2FEEB05CB7198349354E9E67ADE0671EEC3647F351B,IMPHASH=2FEAC3143808B4542A16622000CCFCAE{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 11241100x800000000000000012493Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:09.013{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{64D2613D-A7ED-4A47-84C0-3DAF0DCAA716}\ssshim.dll2025-10-29 13:35:09.013NT AUTHORITY\SYSTEM 11241100x800000000000000012494Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:09.815{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{87922F04-5F6F-4E72-BDD4-804A721113D9}\ssshim.dll2025-10-29 13:35:09.815NT AUTHORITY\SYSTEM 11241100x800000000000000012495Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:10.798{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{6AE7B2A7-B0DB-4CDC-BA20-9444C663461C}\ssshim.dll2025-10-29 13:35:10.798NT AUTHORITY\SYSTEM 11241100x800000000000000012496Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:11.682{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{6BB6DA22-510D-4554-9588-4CF0FF1839D4}\ssshim.dll2025-10-29 13:35:11.682NT AUTHORITY\SYSTEM 11241100x800000000000000012497Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:12.492{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{9EBC1085-A1E4-4DB2-9290-958DDA805BF9}\ssshim.dll2025-10-29 13:35:12.492NT AUTHORITY\SYSTEM 11241100x800000000000000012498Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.786{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{D023A94F-BA33-4F43-B6A9-44C0ECA56614}\ssshim.dll2025-10-29 13:35:13.786NT AUTHORITY\SYSTEM 11241100x800000000000000012499Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.789{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\ScreenSketchAppService\ScreenSketchAppService.dll2025-10-29 13:35:13.789NT AUTHORITY\SYSTEM 11241100x800000000000000012500Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.789{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingToolSandbox\libpng16.dll2025-10-29 13:35:13.789NT AUTHORITY\SYSTEM 11241100x800000000000000012501Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.791{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingToolSandbox\oneocr.dll2025-10-29 13:35:13.791NT AUTHORITY\SYSTEM 11241100x800000000000000012502Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.791{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingToolSandbox\onnxruntime.dll2025-10-29 13:35:13.791NT AUTHORITY\SYSTEM 11241100x800000000000000012503Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.791{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingToolSandbox\opencv_core4.dll2025-10-29 13:35:13.791NT AUTHORITY\SYSTEM 11241100x800000000000000012504Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.791{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingToolSandbox\opencv_highgui4.dll2025-10-29 13:35:13.791NT AUTHORITY\SYSTEM 11241100x800000000000000012505Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.793{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingToolSandbox\opencv_imgcodecs4.dll2025-10-29 13:35:13.791NT AUTHORITY\SYSTEM 11241100x800000000000000012506Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.793{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingToolSandbox\opencv_imgproc4.dll2025-10-29 13:35:13.793NT AUTHORITY\SYSTEM 11241100x800000000000000012507Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.793{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingToolSandbox\opencv_videoio4.dll2025-10-29 13:35:13.793NT AUTHORITY\SYSTEM 11241100x800000000000000012508Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.793{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingToolSandbox\SnippingToolSandbox.dll2025-10-29 13:35:13.793NT AUTHORITY\SYSTEM 11241100x800000000000000012509Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.801{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingToolSandbox\zlib1.dll2025-10-29 13:35:13.801NT AUTHORITY\SYSTEM 11241100x800000000000000012510Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.801{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\libpng16.dll2025-10-29 13:35:13.801NT AUTHORITY\SYSTEM 11241100x800000000000000012511Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.803{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\oneocr.dll2025-10-29 13:35:13.803NT AUTHORITY\SYSTEM 11241100x800000000000000012512Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.803{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\onnxruntime.dll2025-10-29 13:35:13.803NT AUTHORITY\SYSTEM 11241100x800000000000000012513Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.803{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\opencv_core4.dll2025-10-29 13:35:13.803NT AUTHORITY\SYSTEM 11241100x800000000000000012514Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.803{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\opencv_highgui4.dll2025-10-29 13:35:13.803NT AUTHORITY\SYSTEM 11241100x800000000000000012515Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.803{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\opencv_imgcodecs4.dll2025-10-29 13:35:13.803NT AUTHORITY\SYSTEM 11241100x800000000000000012516Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.805{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\opencv_imgproc4.dll2025-10-29 13:35:13.805NT AUTHORITY\SYSTEM 11241100x800000000000000012517Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.805{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\opencv_videoio4.dll2025-10-29 13:35:13.805NT AUTHORITY\SYSTEM 11241100x800000000000000012518Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.805{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\PerceptiveShell\ps-onnxruntime.dll2025-10-29 13:35:13.805NT AUTHORITY\SYSTEM 11241100x800000000000000012519Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.807{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\PerceptiveShell\segapi.dll2025-10-29 13:35:13.805NT AUTHORITY\SYSTEM 11241100x800000000000000012520Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:13.807{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\SnippingTool.exe2025-10-29 13:35:13.807NT AUTHORITY\SYSTEM 11241100x800000000000000012521Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.807{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\SnippingToolUI.dll2025-10-29 13:35:13.807NT AUTHORITY\SYSTEM 11241100x800000000000000012522Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:13.815{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\SnippingTool\zlib1.dll2025-10-29 13:35:13.815NT AUTHORITY\SYSTEM 11241100x800000000000000012523Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:14.614{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{D219353C-F33D-468B-9549-019F981CD07A}\ssshim.dll2025-10-29 13:35:14.614NT AUTHORITY\SYSTEM 11241100x800000000000000012524Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.110{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.App.dll2025-10-29 13:35:15.110NT AUTHORITY\SYSTEM 11241100x800000000000000012525Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:15.112{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.App.exe2025-10-29 13:35:15.112NT AUTHORITY\SYSTEM 11241100x800000000000000012526Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.114{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Microsoft.Marketplace.Storefront.Telemetry.Contracts.dll2025-10-29 13:35:15.114NT AUTHORITY\SYSTEM 11241100x800000000000000012527Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.116{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Microsoft.Telemetry.Metadata.dll2025-10-29 13:35:15.114NT AUTHORITY\SYSTEM 11241100x800000000000000012528Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.116{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shared.Instrumentation.dll2025-10-29 13:35:15.116NT AUTHORITY\SYSTEM 11241100x800000000000000012529Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.116{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shared.Models.dll2025-10-29 13:35:15.116NT AUTHORITY\SYSTEM 11241100x800000000000000012530Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.118{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shared.Services.dll2025-10-29 13:35:15.116NT AUTHORITY\SYSTEM 11241100x800000000000000012531Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.118{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shmuelie.WinRTServer.dll2025-10-29 13:35:15.118NT AUTHORITY\SYSTEM 11241100x800000000000000012532Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:15.120{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe2025-10-29 13:35:15.120NT AUTHORITY\SYSTEM 11241100x800000000000000012533Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.120{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\System.Diagnostics.EventLog.dll2025-10-29 13:35:15.120NT AUTHORITY\SYSTEM 11241100x800000000000000012534Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.122{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\System.Security.Principal.Windows.dll2025-10-29 13:35:15.122NT AUTHORITY\SYSTEM 11241100x800000000000000012535Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.122{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\System.ServiceProcess.ServiceController.dll2025-10-29 13:35:15.122NT AUTHORITY\SYSTEM 11241100x800000000000000012536Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.122{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.Common.dll2025-10-29 13:35:15.122NT AUTHORITY\SYSTEM 11241100x800000000000000012537Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.124{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.DesktopExtension.Contracts.dll2025-10-29 13:35:15.122NT AUTHORITY\SYSTEM 11241100x800000000000000012538Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.124{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.Instrumentation.dll2025-10-29 13:35:15.124NT AUTHORITY\SYSTEM 11241100x800000000000000012539Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.124{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.Interop.dll2025-10-29 13:35:15.124NT AUTHORITY\SYSTEM 11241100x800000000000000012540Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.124{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.Polyfills.dll2025-10-29 13:35:15.124NT AUTHORITY\SYSTEM 11241100x800000000000000012541Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.126{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.Services.Abstractions.dll2025-10-29 13:35:15.126NT AUTHORITY\SYSTEM 11241100x800000000000000012542Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.126{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.Services.dll2025-10-29 13:35:15.126NT AUTHORITY\SYSTEM 11241100x800000000000000012543Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.126{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.Services.Instrumentation.dll2025-10-29 13:35:15.126NT AUTHORITY\SYSTEM 11241100x800000000000000012544Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:15.600{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Clipchamp.Clipchamp_4.4.10420.0_x64__yxz26nhyzhsrt\Clipchamp.ShellExtension.dll2025-10-29 13:35:15.600NT AUTHORITY\SYSTEM 11241100x800000000000000012545Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:15.604{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Clipchamp.Clipchamp_4.4.10420.0_x64__yxz26nhyzhsrt\Clipchamp\Clipchamp.exe2025-10-29 13:35:15.604NT AUTHORITY\SYSTEM 11241100x800000000000000012546Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:16.270{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{1B5520E2-14BE-446B-BA1B-24E67DB997A9}\ssshim.dll2025-10-29 13:35:16.270NT AUTHORITY\SYSTEM 11241100x800000000000000012547Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:17.076{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{503D91B6-E80E-4055-AB87-1105ECE4046D}\ssshim.dll2025-10-29 13:35:17.076NT AUTHORITY\SYSTEM 11241100x800000000000000012548Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:27.832{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{395D8DEB-5D1E-4DC8-BF97-EEDDE74BA780}\ssshim.dll2025-10-29 13:35:27.832NT AUTHORITY\SYSTEM 11241100x800000000000000012549Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:28.609{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Users\Administrator\AppData\Local\Microsoft\WindowsApps\SnippingTool.exe2025-09-03 13:55:22.305NT AUTHORITY\SYSTEM 11241100x800000000000000012550Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:28.611{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Users\Administrator\AppData\Local\Microsoft\WindowsApps\Microsoft.ScreenSketch_8wekyb3d8bbwe\SnippingTool.exe2025-10-29 13:35:28.611NT AUTHORITY\SYSTEM 11241100x800000000000000012551Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:28.863{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{8EEC2F22-B64C-486D-8BBA-E8AA1B32CAF8}\ssshim.dll2025-10-29 13:35:28.863NT AUTHORITY\SYSTEM 11241100x800000000000000012552Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:30.979{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{24BB0A51-05CD-4E8E-8377-B5E46137A41A}\ssshim.dll2025-10-29 13:35:30.979NT AUTHORITY\SYSTEM 11241100x800000000000000012553Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:31.846{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{F725BADD-0E43-4198-857B-9D902E3DB54F}\ssshim.dll2025-10-29 13:35:31.846NT AUTHORITY\SYSTEM 11241100x800000000000000012554Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:32.963{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{BED5F566-DD6D-4025-8772-2103A60E0888}\ssshim.dll2025-10-29 13:35:32.963NT AUTHORITY\SYSTEM 154100x800000000000000012555Microsoft-Windows-Sysmon/Operationalsoc101win11-2025-10-29 13:35:33.515{8223a6b9-1825-6902-e202-000000002b00}3196C:\Windows\System32\wermgr.exe10.0.26100.4768 (WinBuild.160101.0800)Windows Problem ReportingMicrosoft® Windows® Operating SystemMicrosoft CorporationWerMgr"C:\WINDOWS\system32\wermgr.exe" -uploadC:\WINDOWS\system32\NT AUTHORITY\SYSTEM{8223a6b9-1315-6902-e703-000000000000}0x3e70SystemMD5=ABE1D752643419A8252520AABF75C29D,SHA256=1707CB793B8F64B65CA5C2FEEB05CB7198349354E9E67ADE0671EEC3647F351B,IMPHASH=2FEAC3143808B4542A16622000CCFCAE{8223a6b9-1316-6902-1c00-000000002b00}1588C:\Windows\System32\svchost.exeC:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM 11241100x800000000000000012556Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:33.858{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{04C5AD0E-0AF0-4DC7-9DED-88E94D6178B8}\ssshim.dll2025-10-29 13:35:33.858NT AUTHORITY\SYSTEM 11241100x800000000000000012557Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:34.695{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{9D2AF69A-55CC-43C5-9030-62CB5D2A032F}\ssshim.dll2025-10-29 13:35:34.695NT AUTHORITY\SYSTEM 11241100x800000000000000012558Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:36.180{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{B07723CB-3F31-4188-99C3-E77B31EF4DD8}\ssshim.dll2025-10-29 13:35:36.180NT AUTHORITY\SYSTEM 11241100x800000000000000012559Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:37.008{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{BAF118C3-E7AE-4C6F-AB9C-F53E41A6E7C7}\ssshim.dll2025-10-29 13:35:37.008NT AUTHORITY\SYSTEM 11241100x800000000000000012560Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.128{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{B470FAC8-6416-44A2-9970-C57A968078D8}\ssshim.dll2025-10-29 13:35:38.128NT AUTHORITY\SYSTEM 11241100x800000000000000012561Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.294{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.dll2025-10-29 13:35:38.294NT AUTHORITY\SYSTEM 11241100x800000000000000012562Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:38.294{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe2025-10-29 13:35:38.294NT AUTHORITY\SYSTEM 11241100x800000000000000012563Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.294{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalcViewModel.dll2025-10-29 13:35:38.294NT AUTHORITY\SYSTEM 11241100x800000000000000012564Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.294{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\GraphControl.dll2025-10-29 13:35:38.294NT AUTHORITY\SYSTEM 11241100x800000000000000012565Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.296{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\GraphingImpl.dll2025-10-29 13:35:38.296NT AUTHORITY\SYSTEM 11241100x800000000000000012566Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.296{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\TraceLogging.dll2025-10-29 13:35:38.296NT AUTHORITY\SYSTEM 11241100x800000000000000012567Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.777{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\bg-BG\PAD.Console.Host.resources.dll2025-10-29 13:35:38.777NT AUTHORITY\SYSTEM 11241100x800000000000000012568Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.777{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\ca-ES\PAD.Console.Host.resources.dll2025-10-29 13:35:38.777NT AUTHORITY\SYSTEM 11241100x800000000000000012569Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.777{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\cs-CZ\PAD.Console.Host.resources.dll2025-10-29 13:35:38.777NT AUTHORITY\SYSTEM 11241100x800000000000000012570Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.781{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\da-DK\PAD.Console.Host.resources.dll2025-10-29 13:35:38.781NT AUTHORITY\SYSTEM 11241100x800000000000000012571Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.783{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\de-DE\PAD.Console.Host.resources.dll2025-10-29 13:35:38.783NT AUTHORITY\SYSTEM 11241100x800000000000000012572Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.785{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\el-GR\PAD.Console.Host.resources.dll2025-10-29 13:35:38.785NT AUTHORITY\SYSTEM 11241100x800000000000000012573Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.785{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\es-ES\PAD.Console.Host.resources.dll2025-10-29 13:35:38.785NT AUTHORITY\SYSTEM 11241100x800000000000000012574Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.785{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\et-EE\PAD.Console.Host.resources.dll2025-10-29 13:35:38.785NT AUTHORITY\SYSTEM 11241100x800000000000000012575Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.787{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\eu-ES\PAD.Console.Host.resources.dll2025-10-29 13:35:38.787NT AUTHORITY\SYSTEM 11241100x800000000000000012576Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.789{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\fi-FI\PAD.Console.Host.resources.dll2025-10-29 13:35:38.789NT AUTHORITY\SYSTEM 11241100x800000000000000012577Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.791{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\fr-FR\PAD.Console.Host.resources.dll2025-10-29 13:35:38.791NT AUTHORITY\SYSTEM 11241100x800000000000000012578Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.793{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\gl-ES\PAD.Console.Host.resources.dll2025-10-29 13:35:38.793NT AUTHORITY\SYSTEM 11241100x800000000000000012579Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.793{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\hi-IN\PAD.Console.Host.resources.dll2025-10-29 13:35:38.793NT AUTHORITY\SYSTEM 11241100x800000000000000012580Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.795{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\hr-HR\PAD.Console.Host.resources.dll2025-10-29 13:35:38.795NT AUTHORITY\SYSTEM 11241100x800000000000000012581Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.797{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\hu-HU\PAD.Console.Host.resources.dll2025-10-29 13:35:38.797NT AUTHORITY\SYSTEM 11241100x800000000000000012582Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.797{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\id-ID\PAD.Console.Host.resources.dll2025-10-29 13:35:38.797NT AUTHORITY\SYSTEM 11241100x800000000000000012583Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.799{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\it-IT\PAD.Console.Host.resources.dll2025-10-29 13:35:38.799NT AUTHORITY\SYSTEM 11241100x800000000000000012584Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.801{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\ja-JP\PAD.Console.Host.resources.dll2025-10-29 13:35:38.801NT AUTHORITY\SYSTEM 11241100x800000000000000012585Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.801{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\kk-KZ\PAD.Console.Host.resources.dll2025-10-29 13:35:38.801NT AUTHORITY\SYSTEM 11241100x800000000000000012586Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.803{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\ko-KR\PAD.Console.Host.resources.dll2025-10-29 13:35:38.801NT AUTHORITY\SYSTEM 11241100x800000000000000012587Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.803{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\lt-LT\PAD.Console.Host.resources.dll2025-10-29 13:35:38.803NT AUTHORITY\SYSTEM 11241100x800000000000000012588Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.803{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\lv-LV\PAD.Console.Host.resources.dll2025-10-29 13:35:38.803NT AUTHORITY\SYSTEM 11241100x800000000000000012589Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.807{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\ms-MY\PAD.Console.Host.resources.dll2025-10-29 13:35:38.807NT AUTHORITY\SYSTEM 11241100x800000000000000012590Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.807{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\nb-NO\PAD.Console.Host.resources.dll2025-10-29 13:35:38.807NT AUTHORITY\SYSTEM 11241100x800000000000000012591Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.809{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\nl-NL\PAD.Console.Host.resources.dll2025-10-29 13:35:38.809NT AUTHORITY\SYSTEM 11241100x800000000000000012592Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:38.809{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\PAD.Console.Host.exe2025-10-29 13:35:38.809NT AUTHORITY\SYSTEM 11241100x800000000000000012593Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.809{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\pl-PL\PAD.Console.Host.resources.dll2025-10-29 13:35:38.809NT AUTHORITY\SYSTEM 11241100x800000000000000012594Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.811{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\pt-BR\PAD.Console.Host.resources.dll2025-10-29 13:35:38.811NT AUTHORITY\SYSTEM 11241100x800000000000000012595Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.811{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\pt-PT\PAD.Console.Host.resources.dll2025-10-29 13:35:38.811NT AUTHORITY\SYSTEM 11241100x800000000000000012596Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.813{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\ro-RO\PAD.Console.Host.resources.dll2025-10-29 13:35:38.813NT AUTHORITY\SYSTEM 11241100x800000000000000012597Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.813{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\ru-RU\PAD.Console.Host.resources.dll2025-10-29 13:35:38.813NT AUTHORITY\SYSTEM 11241100x800000000000000012598Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.813{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\sk-SK\PAD.Console.Host.resources.dll2025-10-29 13:35:38.813NT AUTHORITY\SYSTEM 11241100x800000000000000012599Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.815{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\sl-SI\PAD.Console.Host.resources.dll2025-10-29 13:35:38.815NT AUTHORITY\SYSTEM 11241100x800000000000000012600Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.815{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\sr-Cyrl-RS\PAD.Console.Host.resources.dll2025-10-29 13:35:38.815NT AUTHORITY\SYSTEM 11241100x800000000000000012601Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.816{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\sr-Latn-RS\PAD.Console.Host.resources.dll2025-10-29 13:35:38.816NT AUTHORITY\SYSTEM 11241100x800000000000000012602Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.816{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\sv-SE\PAD.Console.Host.resources.dll2025-10-29 13:35:38.816NT AUTHORITY\SYSTEM 11241100x800000000000000012603Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.818{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\th-TH\PAD.Console.Host.resources.dll2025-10-29 13:35:38.818NT AUTHORITY\SYSTEM 11241100x800000000000000012604Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.818{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\tr-TR\PAD.Console.Host.resources.dll2025-10-29 13:35:38.818NT AUTHORITY\SYSTEM 11241100x800000000000000012605Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.818{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\uk-UA\PAD.Console.Host.resources.dll2025-10-29 13:35:38.818NT AUTHORITY\SYSTEM 11241100x800000000000000012606Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.820{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\vi-VN\PAD.Console.Host.resources.dll2025-10-29 13:35:38.820NT AUTHORITY\SYSTEM 11241100x800000000000000012607Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.824{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\zh-CN\PAD.Console.Host.resources.dll2025-10-29 13:35:38.824NT AUTHORITY\SYSTEM 11241100x800000000000000012608Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.826{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.2021.0_x64__8wekyb3d8bbwe\dotnet\zh-TW\PAD.Console.Host.resources.dll2025-10-29 13:35:38.826NT AUTHORITY\SYSTEM 11241100x800000000000000012609Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:38.950{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.23.10160.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.dll2025-10-29 13:35:38.950NT AUTHORITY\SYSTEM 11241100x800000000000000012610Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:38.952{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.23.10160.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe2025-10-29 13:35:38.950NT AUTHORITY\SYSTEM 11241100x800000000000000012611Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:38.952{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.23.10160.0_x64__8wekyb3d8bbwe\Solitaire.exe2025-10-29 13:35:38.952NT AUTHORITY\SYSTEM 11241100x800000000000000012612Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:39.394{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{9DA6954F-EBCF-416B-B962-8BAEFBEC80D5}\ssshim.dll2025-10-29 13:35:39.394NT AUTHORITY\SYSTEM 11241100x800000000000000012613Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:40.375{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{2B1807EB-3135-44D0-A3EE-E42F13D3ED26}\ssshim.dll2025-10-29 13:35:40.375NT AUTHORITY\SYSTEM 11241100x800000000000000012614Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:41.444{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{EC66AE4F-5E7A-4D98-ADE4-47B37B4DA912}\ssshim.dll2025-10-29 13:35:41.444NT AUTHORITY\SYSTEM 11241100x800000000000000012615Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:42.635{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{D698DACC-F9BC-43BA-94B1-BC90E14E77CB}\ssshim.dll2025-10-29 13:35:42.635NT AUTHORITY\SYSTEM 11241100x800000000000000012616Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:43.723{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{C2176EDA-7D8B-4615-AD7D-E6E95658CCC1}\ssshim.dll2025-10-29 13:35:43.723NT AUTHORITY\SYSTEM 11241100x800000000000000012617Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:44.936{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{031F896C-0F0E-4C1E-B067-27D32FDAB75C}\ssshim.dll2025-10-29 13:35:44.936NT AUTHORITY\SYSTEM 11241100x800000000000000012618Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:45.679{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{C3E3C9A7-40A8-43B8-BE57-67D54880F383}\ssshim.dll2025-10-29 13:35:45.679NT AUTHORITY\SYSTEM 11241100x800000000000000012619Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:46.704{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{1A5B9E58-47F6-4E61-8565-15A0B8415813}\ssshim.dll2025-10-29 13:35:46.704NT AUTHORITY\SYSTEM 11241100x800000000000000012620Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:47.771{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{70EF3F22-7A07-4E59-A672-6AEE277595F0}\ssshim.dll2025-10-29 13:35:47.771NT AUTHORITY\SYSTEM 11241100x800000000000000012621Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:48.382{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2510.14102.0_x64__8wekyb3d8bbwe\PilotshubApp.dll2025-10-29 13:35:48.382NT AUTHORITY\SYSTEM 11241100x800000000000000012622Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:48.382{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2510.14102.0_x64__8wekyb3d8bbwe\PilotshubApp.exe2025-10-29 13:35:48.382NT AUTHORITY\SYSTEM 11241100x800000000000000012623Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:48.603{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{30CF1222-6C5D-4F4E-BDD7-79204DC049E2}\ssshim.dll2025-10-29 13:35:48.603NT AUTHORITY\SYSTEM 11241100x800000000000000012624Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:49.614{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{D38ABB24-05ED-4B9D-BDAD-4B29B373A08B}\ssshim.dll2025-10-29 13:35:49.614NT AUTHORITY\SYSTEM 11241100x800000000000000012625Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:50.133{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.StartExperiencesApp_1.151.0.0_x64__8wekyb3d8bbwe\MicrosoftStartFeedProvider\MicrosoftStartFeedProvider.exe2025-10-29 13:35:50.133NT AUTHORITY\SYSTEM 11241100x800000000000000012626Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:50.496{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{F3D9115A-FEEB-4163-87D3-65372BDF5778}\ssshim.dll2025-10-29 13:35:50.496NT AUTHORITY\SYSTEM 11241100x800000000000000012627Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:51.392{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{36DA7CF6-6C8F-4E29-8F76-1899EAC7AA87}\ssshim.dll2025-10-29 13:35:51.392NT AUTHORITY\SYSTEM 11241100x800000000000000012628Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:52.393{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{FBDC56CB-4B35-4E1C-95D4-29A85261A435}\ssshim.dll2025-10-29 13:35:52.391NT AUTHORITY\SYSTEM 11241100x800000000000000012629Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:53.398{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{6AE47429-E771-498A-A7F5-D491ECB56359}\ssshim.dll2025-10-29 13:35:53.396NT AUTHORITY\SYSTEM 11241100x800000000000000012630Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:54.165{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_22509.1401.1.0_x64__8wekyb3d8bbwe\hermes.dll2025-10-29 13:35:54.165NT AUTHORITY\SYSTEM 11241100x800000000000000012631Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:54.165{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_22509.1401.1.0_x64__8wekyb3d8bbwe\Microsoft.ReactNative.dll2025-10-29 13:35:54.165NT AUTHORITY\SYSTEM 11241100x800000000000000012632Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:54.165{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_22509.1401.1.0_x64__8wekyb3d8bbwe\Payments.dll2025-10-29 13:35:54.165NT AUTHORITY\SYSTEM 11241100x800000000000000012633Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:54.165{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_22509.1401.1.0_x64__8wekyb3d8bbwe\ReactNativeWebView.dll2025-10-29 13:35:54.165NT AUTHORITY\SYSTEM 11241100x800000000000000012634Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:54.169{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_22509.1401.1.0_x64__8wekyb3d8bbwe\Saturn.dll2025-10-29 13:35:54.169NT AUTHORITY\SYSTEM 11241100x800000000000000012635Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:54.171{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_22509.1401.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.dll2025-10-29 13:35:54.171NT AUTHORITY\SYSTEM 11241100x800000000000000012636Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:35:54.171{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_22509.1401.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe2025-10-29 13:35:54.171NT AUTHORITY\SYSTEM 11241100x800000000000000012637Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:55.188{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{46325527-F165-4FD5-9AF3-FB8597E2CEFF}\ssshim.dll2025-10-29 13:35:55.188NT AUTHORITY\SYSTEM 11241100x800000000000000012638Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:56.402{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{4CC8D2C0-FBF8-45BD-8CE1-67F9D6E0A087}\ssshim.dll2025-10-29 13:35:56.402NT AUTHORITY\SYSTEM 11241100x800000000000000012639Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:57.700{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{0BBFEF98-AA0D-47A6-931F-8A5E5C9EB06D}\ssshim.dll2025-10-29 13:35:57.700NT AUTHORITY\SYSTEM 11241100x800000000000000012640Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:58.861{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{EB53008A-F101-41B5-9E65-D9ACC40BBDA1}\ssshim.dll2025-10-29 13:35:58.861NT AUTHORITY\SYSTEM 11241100x800000000000000012641Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:35:59.708{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{42120D9A-4368-4B31-90A3-4CD25EB138F5}\ssshim.dll2025-10-29 13:35:59.708NT AUTHORITY\SYSTEM 11241100x800000000000000012642Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:01.126{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{FB0870AC-0BFA-4E98-93C0-B9C0708701F4}\ssshim.dll2025-10-29 13:36:01.126NT AUTHORITY\SYSTEM 11241100x800000000000000012643Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:02.303{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{F08A79D1-B9B0-4835-B2D7-AAA70E00A124}\ssshim.dll2025-10-29 13:36:02.303NT AUTHORITY\SYSTEM 11241100x800000000000000012644Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:03.457{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{3E137482-8510-4137-AC56-FFB077C5C018}\ssshim.dll2025-10-29 13:36:03.457NT AUTHORITY\SYSTEM 11241100x800000000000000012645Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:04.657{8223a6b9-1317-6902-3f00-000000002b00}3008C:\WINDOWS\system32\svchost.exeC:\Windows\SystemTemp\{3C185104-37D2-4876-86C8-B1D3CFD9A04B}\ssshim.dll2025-10-29 13:36:04.657NT AUTHORITY\SYSTEM 11241100x800000000000000012646Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.201{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\AgentIsolationEnvironment.AgentProxy\AgentIsolationEnvironment.NativeInterop.dll2025-10-29 13:36:05.201NT AUTHORITY\SYSTEM 11241100x800000000000000012647Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:36:05.201{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\AgentIsolationEnvironment.AgentProxy\AgentProxy.exe2025-10-29 13:36:05.201NT AUTHORITY\SYSTEM 11241100x800000000000000012648Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:36:05.201{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\AgentIsolationEnvironment.AgentRelay\AgentRelay.exe2025-10-29 13:36:05.201NT AUTHORITY\SYSTEM 11241100x800000000000000012649Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.201{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\AgentIsolationEnvironment.Auditing.dll2025-10-29 13:36:05.201NT AUTHORITY\SYSTEM 11241100x800000000000000012650Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.201{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\AgentIsolationEnvironment.Grpc.dll2025-10-29 13:36:05.201NT AUTHORITY\SYSTEM 11241100x800000000000000012651Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.203{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\AgentIsolationEnvironment.NativeInterop.dll2025-10-29 13:36:05.203NT AUTHORITY\SYSTEM 11241100x800000000000000012652Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.203{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\AgentIsolationEnvironment.NativeInterop.Projection.dll2025-10-29 13:36:05.203NT AUTHORITY\SYSTEM 11241100x800000000000000012653Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.203{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\AgentIsolationEnvironment.PlatformSDK.Projection.dll2025-10-29 13:36:05.203NT AUTHORITY\SYSTEM 11241100x800000000000000012654Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.203{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\AgentIsolationEnvironment.Telemetry.dll2025-10-29 13:36:05.203NT AUTHORITY\SYSTEM 11241100x800000000000000012655Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.205{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\aspnetcorev2_inprocess.dll2025-10-29 13:36:05.205NT AUTHORITY\SYSTEM 11241100x800000000000000012656Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.264{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Azure.Core.dll2025-10-29 13:36:05.264NT AUTHORITY\SYSTEM 11241100x800000000000000012657Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.264{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\clretwrc.dll2025-10-29 13:36:05.264NT AUTHORITY\SYSTEM 11241100x800000000000000012658Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.264{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\clrgc.dll2025-10-29 13:36:05.264NT AUTHORITY\SYSTEM 11241100x800000000000000012659Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.264{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\clrgcexp.dll2025-10-29 13:36:05.264NT AUTHORITY\SYSTEM 11241100x800000000000000012660Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.264{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\clrjit.dll2025-10-29 13:36:05.264NT AUTHORITY\SYSTEM 11241100x800000000000000012661Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.266{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Copilot.dll2025-10-29 13:36:05.266NT AUTHORITY\SYSTEM 11241100x800000000000000012662Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:36:05.266{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Copilot.exe2025-10-29 13:36:05.266NT AUTHORITY\SYSTEM 11241100x800000000000000012663Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.266{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotContext.dll2025-10-29 13:36:05.266NT AUTHORITY\SYSTEM 11241100x800000000000000012664Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:36:05.266{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotContext.exe2025-10-29 13:36:05.266NT AUTHORITY\SYSTEM 11241100x800000000000000012665Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.268{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotNative.AgentEnvironment.dll2025-10-29 13:36:05.266NT AUTHORITY\SYSTEM 11241100x800000000000000012666Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.268{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotNative.Chat.Controls.dll2025-10-29 13:36:05.268NT AUTHORITY\SYSTEM 11241100x800000000000000012667Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.274{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotNative.Contracts.dll2025-10-29 13:36:05.274NT AUTHORITY\SYSTEM 11241100x800000000000000012668Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.274{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotNative.Core.dll2025-10-29 13:36:05.274NT AUTHORITY\SYSTEM 11241100x800000000000000012669Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.274{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotNative.Core.UX.dll2025-10-29 13:36:05.274NT AUTHORITY\SYSTEM 11241100x800000000000000012670Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.276{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotNative.Features.dll2025-10-29 13:36:05.276NT AUTHORITY\SYSTEM 11241100x800000000000000012671Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.320{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotNative.FileExplorerExtension.dll2025-10-29 13:36:05.320NT AUTHORITY\SYSTEM 11241100x800000000000000012672Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.320{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotNative.Platform.Contracts.dll2025-10-29 13:36:05.320NT AUTHORITY\SYSTEM 11241100x800000000000000012673Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.322{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotNative.Platform.dll2025-10-29 13:36:05.322NT AUTHORITY\SYSTEM 11241100x800000000000000012674Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.324{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotNative.Voice.dll2025-10-29 13:36:05.324NT AUTHORITY\SYSTEM 11241100x800000000000000012675Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.326{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotWidgets.dll2025-10-29 13:36:05.326NT AUTHORITY\SYSTEM 11241100x800000000000000012676Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:36:05.326{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\CopilotWidgets.exe2025-10-29 13:36:05.326NT AUTHORITY\SYSTEM 11241100x800000000000000012677Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.326{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\coreclr.dll2025-10-29 13:36:05.326NT AUTHORITY\SYSTEM 11241100x800000000000000012678Microsoft-Windows-Sysmon/Operationalsoc101win11EXE2025-10-29 13:36:05.326{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\createdump.exe2025-10-29 13:36:05.326NT AUTHORITY\SYSTEM 11241100x800000000000000012679Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.328{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\hostfxr.dll2025-10-29 13:36:05.328NT AUTHORITY\SYSTEM 11241100x800000000000000012680Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.328{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\hostpolicy.dll2025-10-29 13:36:05.328NT AUTHORITY\SYSTEM 11241100x800000000000000012681Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.328{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Antiforgery.dll2025-10-29 13:36:05.328NT AUTHORITY\SYSTEM 11241100x800000000000000012682Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.328{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Authentication.Abstractions.dll2025-10-29 13:36:05.328NT AUTHORITY\SYSTEM 11241100x800000000000000012683Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.328{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Authentication.BearerToken.dll2025-10-29 13:36:05.328NT AUTHORITY\SYSTEM 11241100x800000000000000012684Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.330{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Authentication.Cookies.dll2025-10-29 13:36:05.330NT AUTHORITY\SYSTEM 11241100x800000000000000012685Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.330{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Authentication.Core.dll2025-10-29 13:36:05.330NT AUTHORITY\SYSTEM 11241100x800000000000000012686Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.330{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Authentication.dll2025-10-29 13:36:05.330NT AUTHORITY\SYSTEM 11241100x800000000000000012687Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.330{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Authentication.OAuth.dll2025-10-29 13:36:05.330NT AUTHORITY\SYSTEM 11241100x800000000000000012688Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.330{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Authorization.dll2025-10-29 13:36:05.330NT AUTHORITY\SYSTEM 11241100x800000000000000012689Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.330{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Authorization.Policy.dll2025-10-29 13:36:05.330NT AUTHORITY\SYSTEM 11241100x800000000000000012690Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.332{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Components.Authorization.dll2025-10-29 13:36:05.330NT AUTHORITY\SYSTEM 11241100x800000000000000012691Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.332{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Components.dll2025-10-29 13:36:05.332NT AUTHORITY\SYSTEM 11241100x800000000000000012692Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.332{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Components.Endpoints.dll2025-10-29 13:36:05.332NT AUTHORITY\SYSTEM 11241100x800000000000000012693Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.332{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Components.Forms.dll2025-10-29 13:36:05.332NT AUTHORITY\SYSTEM 11241100x800000000000000012694Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.332{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Components.Server.dll2025-10-29 13:36:05.332NT AUTHORITY\SYSTEM 11241100x800000000000000012695Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.332{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Components.Web.dll2025-10-29 13:36:05.332NT AUTHORITY\SYSTEM 11241100x800000000000000012696Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.332{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Connections.Abstractions.dll2025-10-29 13:36:05.332NT AUTHORITY\SYSTEM 11241100x800000000000000012697Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.334{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.CookiePolicy.dll2025-10-29 13:36:05.334NT AUTHORITY\SYSTEM 11241100x800000000000000012698Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.334{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Cors.dll2025-10-29 13:36:05.334NT AUTHORITY\SYSTEM 11241100x800000000000000012699Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.334{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Cryptography.Internal.dll2025-10-29 13:36:05.334NT AUTHORITY\SYSTEM 11241100x800000000000000012700Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.334{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Cryptography.KeyDerivation.dll2025-10-29 13:36:05.334NT AUTHORITY\SYSTEM 11241100x800000000000000012701Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.334{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.DataProtection.Abstractions.dll2025-10-29 13:36:05.334NT AUTHORITY\SYSTEM 11241100x800000000000000012702Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.335{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.DataProtection.dll2025-10-29 13:36:05.335NT AUTHORITY\SYSTEM 11241100x800000000000000012703Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.335{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.DataProtection.Extensions.dll2025-10-29 13:36:05.335NT AUTHORITY\SYSTEM 11241100x800000000000000012704Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.335{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Diagnostics.Abstractions.dll2025-10-29 13:36:05.335NT AUTHORITY\SYSTEM 11241100x800000000000000012705Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.335{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Diagnostics.dll2025-10-29 13:36:05.335NT AUTHORITY\SYSTEM 11241100x800000000000000012706Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.335{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Diagnostics.HealthChecks.dll2025-10-29 13:36:05.335NT AUTHORITY\SYSTEM 11241100x800000000000000012707Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.335{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.dll2025-10-29 13:36:05.335NT AUTHORITY\SYSTEM 11241100x800000000000000012708Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.337{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.HostFiltering.dll2025-10-29 13:36:05.335NT AUTHORITY\SYSTEM 11241100x800000000000000012709Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.337{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Hosting.Abstractions.dll2025-10-29 13:36:05.337NT AUTHORITY\SYSTEM 11241100x800000000000000012710Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.337{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Hosting.dll2025-10-29 13:36:05.337NT AUTHORITY\SYSTEM 11241100x800000000000000012711Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.337{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Hosting.Server.Abstractions.dll2025-10-29 13:36:05.337NT AUTHORITY\SYSTEM 11241100x800000000000000012712Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.337{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Html.Abstractions.dll2025-10-29 13:36:05.337NT AUTHORITY\SYSTEM 11241100x800000000000000012713Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.339{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Http.Abstractions.dll2025-10-29 13:36:05.339NT AUTHORITY\SYSTEM 11241100x800000000000000012714Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.339{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Http.Connections.Common.dll2025-10-29 13:36:05.339NT AUTHORITY\SYSTEM 11241100x800000000000000012715Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.339{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Http.Connections.dll2025-10-29 13:36:05.339NT AUTHORITY\SYSTEM 11241100x800000000000000012716Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.341{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Http.dll2025-10-29 13:36:05.341NT AUTHORITY\SYSTEM 11241100x800000000000000012717Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.341{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Http.Extensions.dll2025-10-29 13:36:05.341NT AUTHORITY\SYSTEM 11241100x800000000000000012718Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.341{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Http.Features.dll2025-10-29 13:36:05.341NT AUTHORITY\SYSTEM 11241100x800000000000000012719Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.341{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Http.Results.dll2025-10-29 13:36:05.341NT AUTHORITY\SYSTEM 11241100x800000000000000012720Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.341{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.HttpLogging.dll2025-10-29 13:36:05.341NT AUTHORITY\SYSTEM 11241100x800000000000000012721Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.341{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.HttpOverrides.dll2025-10-29 13:36:05.341NT AUTHORITY\SYSTEM 11241100x800000000000000012722Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.343{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.HttpsPolicy.dll2025-10-29 13:36:05.343NT AUTHORITY\SYSTEM 11241100x800000000000000012723Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.343{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Identity.dll2025-10-29 13:36:05.343NT AUTHORITY\SYSTEM 11241100x800000000000000012724Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.343{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Localization.dll2025-10-29 13:36:05.343NT AUTHORITY\SYSTEM 11241100x800000000000000012725Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.343{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Localization.Routing.dll2025-10-29 13:36:05.343NT AUTHORITY\SYSTEM 11241100x800000000000000012726Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.343{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Metadata.dll2025-10-29 13:36:05.343NT AUTHORITY\SYSTEM 11241100x800000000000000012727Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.346{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.Abstractions.dll2025-10-29 13:36:05.343NT AUTHORITY\SYSTEM 11241100x800000000000000012728Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.346{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.ApiExplorer.dll2025-10-29 13:36:05.346NT AUTHORITY\SYSTEM 11241100x800000000000000012729Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.346{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.Core.dll2025-10-29 13:36:05.346NT AUTHORITY\SYSTEM 11241100x800000000000000012730Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.346{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.Cors.dll2025-10-29 13:36:05.346NT AUTHORITY\SYSTEM 11241100x800000000000000012731Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.346{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.DataAnnotations.dll2025-10-29 13:36:05.346NT AUTHORITY\SYSTEM 11241100x800000000000000012732Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.346{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.dll2025-10-29 13:36:05.346NT AUTHORITY\SYSTEM 11241100x800000000000000012733Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.348{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.Formatters.Json.dll2025-10-29 13:36:05.346NT AUTHORITY\SYSTEM 11241100x800000000000000012734Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.348{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.Formatters.Xml.dll2025-10-29 13:36:05.348NT AUTHORITY\SYSTEM 11241100x800000000000000012735Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.348{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.Localization.dll2025-10-29 13:36:05.348NT AUTHORITY\SYSTEM 11241100x800000000000000012736Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.348{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.Razor.dll2025-10-29 13:36:05.348NT AUTHORITY\SYSTEM 11241100x800000000000000012737Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.348{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.RazorPages.dll2025-10-29 13:36:05.348NT AUTHORITY\SYSTEM 11241100x800000000000000012738Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.348{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.TagHelpers.dll2025-10-29 13:36:05.348NT AUTHORITY\SYSTEM 11241100x800000000000000012739Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.350{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Mvc.ViewFeatures.dll2025-10-29 13:36:05.350NT AUTHORITY\SYSTEM 11241100x800000000000000012740Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.350{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.OutputCaching.dll2025-10-29 13:36:05.350NT AUTHORITY\SYSTEM 11241100x800000000000000012741Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.350{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.RateLimiting.dll2025-10-29 13:36:05.350NT AUTHORITY\SYSTEM 11241100x800000000000000012742Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.350{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Razor.dll2025-10-29 13:36:05.350NT AUTHORITY\SYSTEM 11241100x800000000000000012743Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.350{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Razor.Runtime.dll2025-10-29 13:36:05.350NT AUTHORITY\SYSTEM 11241100x800000000000000012744Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.351{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.RequestDecompression.dll2025-10-29 13:36:05.351NT AUTHORITY\SYSTEM 11241100x800000000000000012745Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.351{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.ResponseCaching.Abstractions.dll2025-10-29 13:36:05.351NT AUTHORITY\SYSTEM 11241100x800000000000000012746Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.351{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.ResponseCaching.dll2025-10-29 13:36:05.351NT AUTHORITY\SYSTEM 11241100x800000000000000012747Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.351{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.ResponseCompression.dll2025-10-29 13:36:05.351NT AUTHORITY\SYSTEM 11241100x800000000000000012748Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.351{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Rewrite.dll2025-10-29 13:36:05.351NT AUTHORITY\SYSTEM 11241100x800000000000000012749Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.353{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Routing.Abstractions.dll2025-10-29 13:36:05.351NT AUTHORITY\SYSTEM 11241100x800000000000000012750Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.353{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Routing.dll2025-10-29 13:36:05.353NT AUTHORITY\SYSTEM 11241100x800000000000000012751Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.353{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Server.HttpSys.dll2025-10-29 13:36:05.353NT AUTHORITY\SYSTEM 11241100x800000000000000012752Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.353{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Server.IIS.dll2025-10-29 13:36:05.353NT AUTHORITY\SYSTEM 11241100x800000000000000012753Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.355{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Server.IISIntegration.dll2025-10-29 13:36:05.353NT AUTHORITY\SYSTEM 11241100x800000000000000012754Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.355{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Server.Kestrel.Core.dll2025-10-29 13:36:05.355NT AUTHORITY\SYSTEM 11241100x800000000000000012755Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.355{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Server.Kestrel.dll2025-10-29 13:36:05.355NT AUTHORITY\SYSTEM 11241100x800000000000000012756Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.355{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes.dll2025-10-29 13:36:05.355NT AUTHORITY\SYSTEM 11241100x800000000000000012757Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.355{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Server.Kestrel.Transport.Quic.dll2025-10-29 13:36:05.355NT AUTHORITY\SYSTEM 11241100x800000000000000012758Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.357{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.dll2025-10-29 13:36:05.355NT AUTHORITY\SYSTEM 11241100x800000000000000012759Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.357{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.Session.dll2025-10-29 13:36:05.357NT AUTHORITY\SYSTEM 11241100x800000000000000012760Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.357{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.SignalR.Common.dll2025-10-29 13:36:05.357NT AUTHORITY\SYSTEM 11241100x800000000000000012761Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.357{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.SignalR.Core.dll2025-10-29 13:36:05.357NT AUTHORITY\SYSTEM 11241100x800000000000000012762Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.357{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.SignalR.dll2025-10-29 13:36:05.357NT AUTHORITY\SYSTEM 11241100x800000000000000012763Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.359{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.SignalR.Protocols.Json.dll2025-10-29 13:36:05.357NT AUTHORITY\SYSTEM 11241100x800000000000000012764Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.359{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.StaticAssets.dll2025-10-29 13:36:05.359NT AUTHORITY\SYSTEM 11241100x800000000000000012765Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.359{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.StaticFiles.dll2025-10-29 13:36:05.359NT AUTHORITY\SYSTEM 11241100x800000000000000012766Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.359{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.WebSockets.dll2025-10-29 13:36:05.359NT AUTHORITY\SYSTEM 11241100x800000000000000012767Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.359{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.AspNetCore.WebUtilities.dll2025-10-29 13:36:05.359NT AUTHORITY\SYSTEM 11241100x800000000000000012768Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.359{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.CognitiveServices.Speech.core.dll2025-10-29 13:36:05.359NT AUTHORITY\SYSTEM 11241100x800000000000000012769Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.361{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.CognitiveServices.Speech.csharp.dll2025-10-29 13:36:05.359NT AUTHORITY\SYSTEM 11241100x800000000000000012770Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.361{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.CognitiveServices.Speech.extension.audio.sys.dll2025-10-29 13:36:05.361NT AUTHORITY\SYSTEM 11241100x800000000000000012771Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.361{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.CognitiveServices.Speech.extension.codec.dll2025-10-29 13:36:05.361NT AUTHORITY\SYSTEM 11241100x800000000000000012772Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.361{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.CognitiveServices.Speech.extension.kws.dll2025-10-29 13:36:05.361NT AUTHORITY\SYSTEM 11241100x800000000000000012773Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.361{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.CognitiveServices.Speech.extension.kws.ort.dll2025-10-29 13:36:05.361NT AUTHORITY\SYSTEM 11241100x800000000000000012774Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.363{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.CognitiveServices.Speech.extension.lu.dll2025-10-29 13:36:05.361NT AUTHORITY\SYSTEM 11241100x800000000000000012775Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.363{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.CSharp.dll2025-10-29 13:36:05.363NT AUTHORITY\SYSTEM 11241100x800000000000000012776Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.363{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Caching.Abstractions.dll2025-10-29 13:36:05.363NT AUTHORITY\SYSTEM 11241100x800000000000000012777Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.363{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Caching.Memory.dll2025-10-29 13:36:05.363NT AUTHORITY\SYSTEM 11241100x800000000000000012778Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.363{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.Abstractions.dll2025-10-29 13:36:05.363NT AUTHORITY\SYSTEM 11241100x800000000000000012779Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.363{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.Binder.dll2025-10-29 13:36:05.363NT AUTHORITY\SYSTEM 11241100x800000000000000012780Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.365{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.CommandLine.dll2025-10-29 13:36:05.365NT AUTHORITY\SYSTEM 11241100x800000000000000012781Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.365{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.dll2025-10-29 13:36:05.365NT AUTHORITY\SYSTEM 11241100x800000000000000012782Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.365{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.EnvironmentVariables.dll2025-10-29 13:36:05.365NT AUTHORITY\SYSTEM 11241100x800000000000000012783Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.367{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.FileExtensions.dll2025-10-29 13:36:05.367NT AUTHORITY\SYSTEM 11241100x800000000000000012784Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.367{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.Ini.dll2025-10-29 13:36:05.367NT AUTHORITY\SYSTEM 11241100x800000000000000012785Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.367{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.Json.dll2025-10-29 13:36:05.367NT AUTHORITY\SYSTEM 11241100x800000000000000012786Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.367{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.KeyPerFile.dll2025-10-29 13:36:05.367NT AUTHORITY\SYSTEM 11241100x800000000000000012787Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.369{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.UserSecrets.dll2025-10-29 13:36:05.369NT AUTHORITY\SYSTEM 11241100x800000000000000012788Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.369{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Configuration.Xml.dll2025-10-29 13:36:05.369NT AUTHORITY\SYSTEM 11241100x800000000000000012789Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.369{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.DependencyInjection.Abstractions.dll2025-10-29 13:36:05.369NT AUTHORITY\SYSTEM 11241100x800000000000000012790Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.369{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.DependencyInjection.dll2025-10-29 13:36:05.369NT AUTHORITY\SYSTEM 11241100x800000000000000012791Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.369{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Diagnostics.Abstractions.dll2025-10-29 13:36:05.369NT AUTHORITY\SYSTEM 11241100x800000000000000012792Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.371{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Diagnostics.dll2025-10-29 13:36:05.371NT AUTHORITY\SYSTEM 11241100x800000000000000012793Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.371{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions.dll2025-10-29 13:36:05.371NT AUTHORITY\SYSTEM 11241100x800000000000000012794Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.371{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Diagnostics.HealthChecks.dll2025-10-29 13:36:05.371NT AUTHORITY\SYSTEM 11241100x800000000000000012795Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.371{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Features.dll2025-10-29 13:36:05.371NT AUTHORITY\SYSTEM 11241100x800000000000000012796Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.371{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.FileProviders.Abstractions.dll2025-10-29 13:36:05.371NT AUTHORITY\SYSTEM 11241100x800000000000000012797Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.373{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.FileProviders.Composite.dll2025-10-29 13:36:05.373NT AUTHORITY\SYSTEM 11241100x800000000000000012798Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.373{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.FileProviders.Embedded.dll2025-10-29 13:36:05.373NT AUTHORITY\SYSTEM 11241100x800000000000000012799Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.373{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.FileProviders.Physical.dll2025-10-29 13:36:05.373NT AUTHORITY\SYSTEM 11241100x800000000000000012800Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.373{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.FileSystemGlobbing.dll2025-10-29 13:36:05.373NT AUTHORITY\SYSTEM 11241100x800000000000000012801Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.373{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Hosting.Abstractions.dll2025-10-29 13:36:05.373NT AUTHORITY\SYSTEM 11241100x800000000000000012802Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.375{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Hosting.dll2025-10-29 13:36:05.375NT AUTHORITY\SYSTEM 11241100x800000000000000012803Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.375{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Hosting.WindowsServices.dll2025-10-29 13:36:05.375NT AUTHORITY\SYSTEM 11241100x800000000000000012804Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.375{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Http.dll2025-10-29 13:36:05.375NT AUTHORITY\SYSTEM 11241100x800000000000000012805Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.375{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Identity.Core.dll2025-10-29 13:36:05.375NT AUTHORITY\SYSTEM 11241100x800000000000000012806Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.375{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Identity.Stores.dll2025-10-29 13:36:05.375NT AUTHORITY\SYSTEM 11241100x800000000000000012807Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.375{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Localization.Abstractions.dll2025-10-29 13:36:05.375NT AUTHORITY\SYSTEM 11241100x800000000000000012808Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.377{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Localization.dll2025-10-29 13:36:05.377NT AUTHORITY\SYSTEM 11241100x800000000000000012809Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.377{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.Abstractions.dll2025-10-29 13:36:05.377NT AUTHORITY\SYSTEM 11241100x800000000000000012810Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.377{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.Configuration.dll2025-10-29 13:36:05.377NT AUTHORITY\SYSTEM 11241100x800000000000000012811Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.377{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.Console.dll2025-10-29 13:36:05.377NT AUTHORITY\SYSTEM 11241100x800000000000000012812Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.377{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.Debug.dll2025-10-29 13:36:05.377NT AUTHORITY\SYSTEM 11241100x800000000000000012813Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.379{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.dll2025-10-29 13:36:05.377NT AUTHORITY\SYSTEM 11241100x800000000000000012814Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.379{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.EventLog.dll2025-10-29 13:36:05.379NT AUTHORITY\SYSTEM 11241100x800000000000000012815Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.379{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.EventSource.dll2025-10-29 13:36:05.379NT AUTHORITY\SYSTEM 11241100x800000000000000012816Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.379{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.TraceSource.dll2025-10-29 13:36:05.379NT AUTHORITY\SYSTEM 11241100x800000000000000012817Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.379{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.ObjectPool.dll2025-10-29 13:36:05.379NT AUTHORITY\SYSTEM 11241100x800000000000000012818Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.381{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Options.ConfigurationExtensions.dll2025-10-29 13:36:05.379NT AUTHORITY\SYSTEM 11241100x800000000000000012819Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.381{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Options.DataAnnotations.dll2025-10-29 13:36:05.381NT AUTHORITY\SYSTEM 11241100x800000000000000012820Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.381{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Options.dll2025-10-29 13:36:05.381NT AUTHORITY\SYSTEM 11241100x800000000000000012821Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.381{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Primitives.dll2025-10-29 13:36:05.381NT AUTHORITY\SYSTEM 11241100x800000000000000012822Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.381{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.WebEncoders.dll2025-10-29 13:36:05.381NT AUTHORITY\SYSTEM 11241100x800000000000000012823Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.383{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.JSInterop.dll2025-10-29 13:36:05.381NT AUTHORITY\SYSTEM 11241100x800000000000000012824Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.383{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Net.Http.Headers.dll2025-10-29 13:36:05.383NT AUTHORITY\SYSTEM 11241100x800000000000000012825Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.383{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Telemetry.dll2025-10-29 13:36:05.383NT AUTHORITY\SYSTEM 11241100x800000000000000012826Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.383{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.VisualBasic.Core.dll2025-10-29 13:36:05.383NT AUTHORITY\SYSTEM 11241100x800000000000000012827Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.383{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.VisualBasic.dll2025-10-29 13:36:05.383NT AUTHORITY\SYSTEM 11241100x800000000000000012828Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.383{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Win32.Primitives.dll2025-10-29 13:36:05.383NT AUTHORITY\SYSTEM 11241100x800000000000000012829Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.385{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Win32.Registry.dll2025-10-29 13:36:05.385NT AUTHORITY\SYSTEM 11241100x800000000000000012830Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.385{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\Microsoft.Windows.SDK.NET.dll2025-10-29 13:36:05.385NT AUTHORITY\SYSTEM 11241100x800000000000000012831Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.385{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\mscordaccore.dll2025-10-29 13:36:05.385NT AUTHORITY\SYSTEM 11241100x800000000000000012832Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.385{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\mscordaccore_amd64_amd64_9.0.625.26613.dll2025-10-29 13:36:05.385NT AUTHORITY\SYSTEM 11241100x800000000000000012833Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.385{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\mscordbi.dll2025-10-29 13:36:05.385NT AUTHORITY\SYSTEM 11241100x800000000000000012834Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.385{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\mscorlib.dll2025-10-29 13:36:05.385NT AUTHORITY\SYSTEM 11241100x800000000000000012835Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.387{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\mscorrc.dll2025-10-29 13:36:05.387NT AUTHORITY\SYSTEM 11241100x800000000000000012836Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.387{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\netstandard.dll2025-10-29 13:36:05.387NT AUTHORITY\SYSTEM 11241100x800000000000000012837Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.387{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.AppContext.dll2025-10-29 13:36:05.387NT AUTHORITY\SYSTEM 11241100x800000000000000012838Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.387{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.Buffers.dll2025-10-29 13:36:05.387NT AUTHORITY\SYSTEM 11241100x800000000000000012839Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.389{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.ClientModel.dll2025-10-29 13:36:05.387NT AUTHORITY\SYSTEM 11241100x800000000000000012840Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.389{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.Collections.Concurrent.dll2025-10-29 13:36:05.389NT AUTHORITY\SYSTEM 11241100x800000000000000012841Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.389{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.Collections.dll2025-10-29 13:36:05.389NT AUTHORITY\SYSTEM 11241100x800000000000000012842Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.389{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.Collections.Immutable.dll2025-10-29 13:36:05.389NT AUTHORITY\SYSTEM 11241100x800000000000000012843Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.389{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.Collections.NonGeneric.dll2025-10-29 13:36:05.389NT AUTHORITY\SYSTEM 11241100x800000000000000012844Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.391{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.Collections.Specialized.dll2025-10-29 13:36:05.391NT AUTHORITY\SYSTEM 11241100x800000000000000012845Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.391{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.ComponentModel.Annotations.dll2025-10-29 13:36:05.391NT AUTHORITY\SYSTEM 11241100x800000000000000012846Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.391{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.ComponentModel.DataAnnotations.dll2025-10-29 13:36:05.391NT AUTHORITY\SYSTEM 11241100x800000000000000012847Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.391{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.ComponentModel.dll2025-10-29 13:36:05.391NT AUTHORITY\SYSTEM 11241100x800000000000000012848Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.391{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.ComponentModel.EventBasedAsync.dll2025-10-29 13:36:05.391NT AUTHORITY\SYSTEM 11241100x800000000000000012849Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.391{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.ComponentModel.Primitives.dll2025-10-29 13:36:05.391NT AUTHORITY\SYSTEM 11241100x800000000000000012850Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.393{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.ComponentModel.TypeConverter.dll2025-10-29 13:36:05.393NT AUTHORITY\SYSTEM 11241100x800000000000000012851Microsoft-Windows-Sysmon/Operationalsoc101win11DLL2025-10-29 13:36:05.393{8223a6b9-131b-6902-7300-000000002b00}5976C:\WINDOWS\system32\svchost.exeC:\Program Files\WindowsApps\Microsoft.Copilot_1.25102.233.0_x64__8wekyb3d8bbwe\System.Configuration.dll2025-10-29 13:36:05.393NT AUTHORITY\SYSTEM