Risk
Medium
Current named detections include activity that warrants analyst review, but the collected evidence does not by itself prove compromise.
Security Events
800
4688 and related Windows Security events
PowerShell Events
647
646 Windows PowerShell + 1 PowerShell Core logs
Sysmon Events
800
Process, DNS, and network telemetry
Likely User Actions
52
Normalized events prioritized for triage
Top 3 Findings
Medium detection
PowerShell to Command Shell
2026-04-16 14:05
Process activity
Related process execution showed `powershell.exe` launched from `powershell.exe`.
2026-04-16 14:06
Correlated telemetry
No correlated DNS/network telemetry was surfaced in the focus window.
2026-04-16 14:05
Case Workflow
Case ID
IR-20260416-170046-LAB-HOST
Automatic case package identifier
Case Priority
Medium
Needs analyst validation
Case Summary
4 detection(s) were highlighted. Highest current detection priority is Medium. Analyst validation is recommended before closing the case.
Top Detections
| Time | Severity | Detection | Evidence |
|---|---|---|---|
| 2026-04-16T14:05:47.6415047-07:00 | Medium | PowerShell to Command Shell | cmd.exe <= powershell.exe | "C:\windows\system32\cmd.exe" /c echo test-from-cmd > "$env:USERPROFILE\Desktop\ir_test_c... |
| 2026-04-16T14:01:13.0255373-07:00 | Low | Browser-Launched Bitdefender Helper Activity | cmd.exe <= chrome.exe | C:\windows\system32\cmd.exe /d /s /c ""C:\Program Files\Bitdefender\Bitdefender Security App\... |
| 2026-04-16T14:05:54.3257807-07:00 | Low | PowerShell Web Request | Invoke-WebRequest -Uri "https://example.com" -OutFile "$env:USERPROFILE\Desktop\example_test.html" |
| 2026-04-16T17:00:58.9330062-07:00 | Low | Process Access (Likely Benign Service Query) | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) |
Recommended Triage Actions
- Review the parent PowerShell command and confirm whether the shell launch was intentional.
- Inspect the child command line and any files written or modified by the command.
- Check nearby DNS/network activity to determine whether the shell launch was part of a download or staging chain.
- Confirm the browser launched a Bitdefender helper from the expected Bitdefender install path.
- Validate signer/path context and check whether the activity aligns with Chrome update, extension, or web-protection behavior.
- Deprioritize if the executable, extension context, and timing match expected Bitdefender browser-security activity.
- Validate whether the destination domain, URL, and saved file path were expected.
- Determine whether the downloaded content was opened, executed, or referenced by later commands.
- Review the PowerShell parent/child process chain and any network or file events around the request.
- Confirm that the source process is a normal Windows service process and the access rights are low-information only.
Next Evidence to Collect
- 4688 events for the parent and child processes
- 4104 script block entries around the event time
- Sysmon DNS/network events within ±5 minutes
- Any files created by the command, including hashes and file metadata
- 4688 lineage from chrome.exe to cmd.exe to the Bitdefender helper
- Executable path and signer details for the Bitdefender helper process
- Chrome extension and browser-update context near the event time
- Any Bitdefender product logs or UI timeline entries related to browser protection
- 4104 entry containing the web request command
- 4688 process lineage for the invoking PowerShell session
- Sysmon DNS/network events for the destination domain and remote IPs
- The downloaded file on disk, including hash, size, path, and signer details
Detections
| Time | Severity | Detection Name | ATT&CK | Evidence | Why It Fired | Recommended Analyst Action |
|---|---|---|---|---|---|---|
| 2026-04-16T14:05:47.6415047-07:00 | Medium | PowerShell to Command Shell | T1059.001 Command and Scripting Interpreter: PowerShell [Execution; Medium]; T1059.003 Command and Scriptin... | cmd.exe <= powershell.exe | "C:\windows\system32\cmd.exe" /c echo test-from-cmd > "$env:USERPROFILE\Desktop\ir_test_cmd.txt" | PowerShell launched cmd.exe, a common staging and execution pattern for administrative tooling and attacker tradecraft. | Review the parent PowerShell command, child command line, created files, and nearby network activity. |
| 2026-04-16T17:00:58.9330062-07:00 | Low | Process Access (Likely Benign Service Query) | — | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Sysmon recorded limited-information process access from a common Windows service process. This often reflects routine inspection by Windo... | Validate the source/target processes and determine whether debugging, security tooling, or legitimate software can explain the behavior. |
| 2026-04-16T14:05:54.3257807-07:00 | Low | PowerShell Web Request | T1059.001 Command and Scripting Interpreter: PowerShell [Execution; High]; T1105 Ingress Tool Transfer [Com... | Invoke-WebRequest -Uri "https://example.com" -OutFile "$env:USERPROFILE\Desktop\example_test.html" | PowerShell issued a web request command to a known safe/test destination often used for validation or expected administrative activity. (... | Validate that the destination and saved output were expected, then deprioritize unless other stronger signals are present. |
| 2026-04-16T14:01:13.0255373-07:00 | Low | Browser-Launched Bitdefender Helper Activity | — | cmd.exe <= chrome.exe | C:\windows\system32\cmd.exe /d /s /c ""C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackers... | A browser spawned a Bitdefender helper from the expected Bitdefender install path. This commonly reflects legitimate browser-protection o... | Validate the helper path, signer, and browser/extension context, then deprioritize if it matches expected Bitdefender activity. |
Why This Matters
- Medium — PowerShell to Command Shell: PowerShell launched cmd.exe, a common staging and execution pattern for administrative tooling and attacker tradecraft.
- Low — Process Access (Likely Benign Service Query): Sysmon recorded limited-information process access from a common Windows service process. This often reflects routine inspection by Windows, management components, or security tooling rather than code injection.
- Low — PowerShell Web Request: PowerShell issued a web request command to a known safe/test destination often used for validation or expected administrative activity. (https://example.com, outfile=$env:USERPROFILE\Desktop\example_test.html)
- Low — Browser-Launched Bitdefender Helper Activity: A browser spawned a Bitdefender helper from the expected Bitdefender install path. This commonly reflects legitimate browser-protection or extension integration activity rather than malware by itself.
ATT&CK Coverage
| Tactic(s) | Technique ID | Technique Name | Mapped Detection(s) | Confidence |
|---|---|---|---|---|
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell | PowerShell Web Request, PowerShell to Command Shell | High |
| Execution | T1059.003 | Command and Scripting Interpreter: Windows Command Shell | PowerShell to Command Shell | High |
| Command and Control | T1105 | Ingress Tool Transfer | PowerShell Web Request | Medium |
ATT&CK mappings are analyst-facing tags attached to named detections. They describe likely tradecraft alignment without changing the underlying event evidence or the core severity logic.
Host Summary
| Field | Value |
|---|---|
| Computer | LAB-HOST |
| User | labuser |
| OS | Microsoft Windows 11 Pro (10.0.26200 build 26200) |
| Last Boot | /Date(1776271137499)/ |
| Sysmon Service | {"Name": "Sysmon", "DisplayName": "Sysmon", "Status": 4, "StartType": 2} |
| Bitdefender Services | [{"Name": "BDAppSrv", "DisplayName": "Bitdefender App Service", "Status": 4, "StartType": 2}, {"Name": "BDAuxSrv", "DisplayName": "Bitdefender Auxiliary Service", "Status": 4, "StartType": 2}, {"Name": "BDESVC", "DisplayName": "BitLocker Drive Enc... |
| Defender Status | {"AMServiceEnabled": false, "AntispywareEnabled": false, "AntivirusEnabled": false, "RealTimeProtectionEnabled": false, "AMRunningMode": "Not running", "AntivirusSignatureLastUpdated": null} |
| Run as Admin | True |
Visibility & Counts
Visibility Check
| Log | Exists | Collected Events |
|---|---|---|
| Security | True | 800 |
| System | True | 10 |
| Windows Defender | True | 1 |
| PowerShell | True | 646 |
| PowerShell Core | True | 1 |
| Sysmon | True | 800 |
Counts
| Artifact | Count |
|---|---|
| security_events | 800 |
| system_events | 10 |
| defender_events | 1 |
| powershell_events | 647 |
| sysmon_events | 800 |
| run_key_entries | 8 |
| startup_entries | 2 |
| powershell_windows_events | 646 |
| powershell_core_events | 1 |
| powershell_events_total | 647 |
Activity Views
Likely User Actions (52 events)
| Time | Source | Type | Actor | Image | Summary | Why |
|---|---|---|---|---|---|---|
| 2026-04-16T16:57:12.2964681-07:00 | Security 4688 | process | labuser | C:\Users\labuser\Downloads\Windows Notepad Installer.exe | Windows Notepad Installer.exe <= explorer.exe | "C:\Users\labuser\Downloads\Windows Notepad Installer.exe" | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T16:56:06.9443720-07:00 | Security 4688 | process | labuser | C:\Windows\System32\Taskmgr.exe | Taskmgr.exe <= explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T16:54:01.4614101-07:00 | Security 4688 | process | labuser | C:\Windows\System32\Taskmgr.exe | Taskmgr.exe <= explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T16:45:21.0704054-07:00 | Security 4688 | process | labuser | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Sh... | ai.exe <= WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "DD1E5E92-DC37-4A7D-84A1-7DB2C... | interactive user account |
| 2026-04-16T16:45:12.7882833-07:00 | Security 4688 | process | labuser | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Sh... | ai.exe <= WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "B7FE164E-4CCE-4502-AD82-E6D18... | interactive user account |
| 2026-04-16T16:45:12.3206527-07:00 | Security 4688 | process | labuser | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Sh... | aimgr.exe <= WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\aimgr.exe" | interactive user account |
| 2026-04-16T16:45:12.2917914-07:00 | Security 4688 | process | labuser | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Sh... | aimgr.exe <= WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\aimgr.exe" | interactive user account |
| 2026-04-16T16:45:11.3249009-07:00 | Security 4688 | process | labuser | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE | WINWORD.EXE <= explorer.exe | "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE" | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T14:11:05.4295475-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Remove-Item "$env:USERPROFILE\Desktop\ir_file_test_renamed.txt" | user-entered script block | |
| 2026-04-16T14:10:58.2641530-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Rename-Item "$env:USERPROFILE\Desktop\ir_file_test.txt" "ir_file_test_renamed.txt" | user-entered script block | |
| 2026-04-16T14:10:53.0971982-07:00 | PowerShell 4104 | scriptblock | powershell.exe | echo test > "$env:USERPROFILE\Desktop\ir_file_test.txt" | user-entered script block | |
| 2026-04-16T14:07:56.1522067-07:00 | Security 4688 | process | labuser | C:\Windows\System32\reg.exe | reg.exe <= powershell.exe | "C:\windows\system32\reg.exe" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v IRTestRun /f | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:07:56.1513289-07:00 | PowerShell 4104 | scriptblock | powershell.exe | reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v IRTestRun /f | user-entered script block | |
| 2026-04-16T14:07:50.5459539-07:00 | Security 4688 | process | labuser | C:\Windows\System32\reg.exe | reg.exe <= powershell.exe | "C:\windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v IRTestRun /t REG_SZ /d notepad.exe /f | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:07:50.5450904-07:00 | PowerShell 4104 | scriptblock | powershell.exe | reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v IRTestRun /t REG_SZ /d "notepad.exe" /f | user-entered script block | |
| 2026-04-16T14:07:41.3546549-07:00 | Security 4688 | process | labuser | C:\Windows\System32\schtasks.exe | schtasks.exe <= powershell.exe | "C:\windows\system32\schtasks.exe" /delete /tn IRTestTask /f | interactive user account; interactive parent: powershell.exe; script host / LOLBin / admin tool |
| 2026-04-16T14:07:41.3538042-07:00 | PowerShell 4104 | scriptblock | powershell.exe | schtasks /delete /tn IRTestTask /f | user-entered script block | |
| 2026-04-16T14:07:30.4719301-07:00 | Security 4688 | process | labuser | C:\Windows\System32\schtasks.exe | schtasks.exe <= powershell.exe | "C:\windows\system32\schtasks.exe" /create /sc once /tn IRTestTask /tr notepad.exe /st 23:59 /f | interactive user account; interactive parent: powershell.exe; script host / LOLBin / admin tool |
| 2026-04-16T14:07:30.4709468-07:00 | PowerShell 4104 | scriptblock | powershell.exe | schtasks /create /sc once /tn IRTestTask /tr "notepad.exe" /st 23:59 /f | user-entered script block | |
| 2026-04-16T14:07:07.0576214-07:00 | Security 4688 | process | labuser | C:\Windows\System32\NETSTAT.EXE | NETSTAT.EXE <= powershell.exe | "C:\windows\system32\NETSTAT.EXE" -ano | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:07:07.0553429-07:00 | PowerShell 4104 | scriptblock | powershell.exe | netstat -ano | user-entered script block | |
| 2026-04-16T14:07:02.1141920-07:00 | Security 4688 | process | labuser | C:\Windows\System32\whoami.exe | whoami.exe <= powershell.exe | "C:\windows\system32\whoami.exe" /all | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:07:02.1131368-07:00 | PowerShell 4104 | scriptblock | powershell.exe | whoami /all | user-entered script block | |
| 2026-04-16T14:06:57.2988993-07:00 | Security 4688 | process | labuser | C:\Windows\System32\ipconfig.exe | ipconfig.exe <= powershell.exe | "C:\windows\system32\ipconfig.exe" /all | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:06:57.2979833-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ipconfig /all | user-entered script block | |
| 2026-04-16T14:06:50.7902724-07:00 | Security 4688 | process | labuser | C:\Windows\System32\schtasks.exe | schtasks.exe <= powershell.exe | "C:\windows\system32\schtasks.exe" /query | interactive user account; interactive parent: powershell.exe; script host / LOLBin / admin tool |
| 2026-04-16T14:06:50.7893683-07:00 | PowerShell 4104 | scriptblock | powershell.exe | schtasks /query | user-entered script block | |
| 2026-04-16T14:06:43.6075774-07:00 | Security 4688 | process | labuser | C:\Windows\System32\reg.exe | reg.exe <= powershell.exe | "C:\windows\system32\reg.exe" query HKCU\Software | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:06:43.6065777-07:00 | PowerShell 4104 | scriptblock | powershell.exe | reg query HKCU\Software | user-entered script block | |
| 2026-04-16T14:06:34.5377140-07:00 | Security 4688 | process | labuser | C:\Windows\System32\Taskmgr.exe | Taskmgr.exe <= powershell.exe | "C:\windows\system32\Taskmgr.exe" | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:06:34.5367202-07:00 | PowerShell 4104 | scriptblock | powershell.exe | taskmgr.exe | user-entered script block | |
| 2026-04-16T14:06:28.9009668-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Get-StartApps | user-entered script block | |
| 2026-04-16T14:06:01.0964483-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Get-Process | Select-Object -First 5 | user-entered script block | |
| 2026-04-16T14:06:00.8308323-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= powershell.exe | "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Get-Process | Select-Object -First 5" | interactive user account; interactive parent: powershell.exe; script host / LOLBin / admin tool |
| 2026-04-16T14:06:00.8273074-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Start-Process powershell.exe -ArgumentList '-NoProfile -Command "Get-Process | Select-Object -First 5"' | user-entered script block | |
| 2026-04-16T14:05:54.3257807-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Invoke-WebRequest -Uri "https://example.com" -OutFile "$env:USERPROFILE\Desktop\example_test.html" | exact supportive scriptblock tied to strongest chain; contains dual-use or suspicious keywords | |
| 2026-04-16T14:05:47.6415047-07:00 | Security 4688 | process | labuser | C:\Windows\System32\cmd.exe | cmd.exe <= powershell.exe | "C:\windows\system32\cmd.exe" /c echo test-from-cmd > "$env:USERPROFILE\Desktop\ir_test_cmd.txt" | interactive user account; interactive parent: powershell.exe; script host / LOLBin / admin tool |
| 2026-04-16T14:05:47.6081782-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Start-Process cmd.exe -ArgumentList '/c echo test-from-cmd > "$env:USERPROFILE\Desktop\ir_test_cmd.txt"' | exact supportive scriptblock tied to strongest chain | |
| 2026-04-16T14:05:27.7254801-07:00 | Security 4688 | process | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= Notepad.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" /SESSION:XHqjvG+npU+... | interactive user account |
| 2026-04-16T14:05:27.6957006-07:00 | Security 4688 | process | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= powershell.exe | "C:\windows\system32\notepad.exe" | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:05:27.6772009-07:00 | PowerShell 4104 | scriptblock | powershell.exe | notepad.exe | exact supportive scriptblock tied to strongest chain | |
| 2026-04-16T14:05:21.5848398-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= WindowsTerminal.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe | interactive user account; script host / LOLBin / admin tool |
| 2026-04-16T14:05:21.1789212-07:00 | Security 4688 | process | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wek... | wt.exe <= explorer.exe | "C:\Users\labuser\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe" -p {61c54bbd-c2c6-5271-96e7-009a... | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T14:03:29.1192334-07:00 | Security 4688 | process | labuser | C:\Program Files\Wireshark\Wireshark.exe | Wireshark.exe <= explorer.exe | "C:\Program Files\Wireshark\Wireshark.exe" | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T14:03:17.7096708-07:00 | Security 4688 | process | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= Notepad.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" | interactive user account |
| 2026-04-16T14:03:08.3167830-07:00 | Security 4688 | process | labuser | C:\Windows\System32\Taskmgr.exe | Taskmgr.exe <= explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T14:01:13.0703067-07:00 | Security 4688 | process | labuser | C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe | bdtrackersnmh.exe <= cmd.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe" chrome-extension://khndhdhbebhaddchcgnalcjlaekbbeof... | browser-launched Bitdefender helper activity |
| 2026-04-16T14:01:13.0255373-07:00 | Security 4688 | process | labuser | C:\Windows\System32\cmd.exe | cmd.exe <= chrome.exe | C:\windows\system32\cmd.exe /d /s /c ""C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe" chrome-extension://kh... | browser-launched Bitdefender helper activity |
| 2026-04-16T14:01:10.1114778-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T14:00:57.6545590-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T13:42:16.0972948-07:00 | Security 4688 | process | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= Notepad.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\Desk... | interactive user account |
| 2026-04-16T13:42:01.2918435-07:00 | Security 4688 | process | labuser | C:\Windows\System32\Taskmgr.exe | Taskmgr.exe <= explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | interactive user account; interactive parent: explorer.exe |
Benign / Background Activity (2194 events)
| Time | Source | Type | Actor | Image | Summary | Why |
|---|---|---|---|---|---|---|
| 2026-04-16T17:00:59.3619195-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3617683-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3617585-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3617211-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3616974-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3616783-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3616688-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3616590-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3615793-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3615700-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3615607-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3615443-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3613657-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3607183-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3607032-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3606937-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3606783-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3606688-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3606477-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3606315-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3606223-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3606125-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3605657-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3605563-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3605407-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3605307-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3604880-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3604604-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3604443-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3604350-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3604247-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3602804-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3602710-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3602604-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3602079-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3600381-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3572419-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:59.3568762-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:59.3566771-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:59.3559050-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Pub... | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3527198-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3527105-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3526949-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3526836-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3526741-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3526518-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3526365-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3526274-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3526178-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3525978-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3525883-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3524348-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3524252-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3523749-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3523656-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3523560-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3523209-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3523111-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3521638-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3521546-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3521448-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3520923-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3519310-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3513883-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3513728-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3513633-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3513483-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3513388-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3513159-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3513009-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3512913-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3512812-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3512330-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3512154-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3512001-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3511901-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3511476-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3511207-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3511042-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3510948-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3510848-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3509835-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3509742-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3509644-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3509474-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3506221-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3437401-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:59.3432910-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:59.3430565-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:59.3414373-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Pub... | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.3002706-07:00 | Sysmon 17 | other | C:\Program Files\WindowsApps\AD2F1837.OMENCommandCenter_1101.2603.3.0_x64__v1... | OmenCommandCenterBackground.exe created pipe \PerformanceControlPerformanceMonitorBgGPU_SIMPLE2 | extended sysmon telemetry | |
| 2026-04-16T17:00:59.2996657-07:00 | Sysmon 18 | other | C:\Program Files\WindowsApps\AD2F1837.OMENCommandCenter_1101.2603.3.0_x64__v1... | OmenCommandCenterBackground.exe connected to pipe \PerformanceControlPerformanceMonitorBgGPU_SIMPLE2 | extended sysmon telemetry | |
| 2026-04-16T17:00:59.2728054-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\System\CurrentControlSet\Services\Tcpip\Parameters | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1792856-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c2a3f323-ae1a-405a-8908-8deccd680a54} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1790338-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{a8f6aa25-3875-4314-a9ec-96f4c7de01ec} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1785684-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{863b8238-6e94-4ed2-b697-f2d8d6ef254e} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1784329-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{8b5346a4-d36e-40e2-bfbc-759efb7bd400} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1775684-07:00 | Sysmon 13 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (SetValue) HKLM\SYSTEM\Software\Microsoft\TIP\AggregateResults\data | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1774414-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (CreateKey) HKLM\SYSTEM\Software\Microsoft\TIP\AggregateResults | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1773828-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (CreateKey) HKLM\SYSTEM\Software\Microsoft\TIP\AggregateResults | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1773673-07:00 | Sysmon 13 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (SetValue) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\State | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1772725-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1772611-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (DeleteKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1772008-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1771055-07:00 | Sysmon 13 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (SetValue) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Maintenance | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1770137-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1769973-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1762209-07:00 | Sysmon 18 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | powershell.EXE connected to pipe \{7FCB1218-D9DD-4E13-91C0-4EE04F8B8C90} | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:59.1749771-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\EventType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1749609-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\EventType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1747392-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\EventType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1746993-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\ExtendedRegistrationData | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1746683-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\PackageFlags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1746428-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\PsmActivationType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1746150-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\PackageRelativeAppName | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1745882-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\TaskEntryPoint | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1745578-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\TriggerEvent | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1745274-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\Name | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1744982-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1744667-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\Conditions | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1744321-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\ActivationType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1743834-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1688201-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed svchost.exe (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1684193-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\UserSid | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1683931-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\PackageFullName | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1683262-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1682965-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\EventParameters | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1682725-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\BrokerId | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1682351-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1594490-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\UserSid | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1594396-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\PackageFullName | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1594302-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1594206-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\EventParameters | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1594106-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\BrokerId | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1593942-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1377636-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\UserSid | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1377435-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\PackageFullName | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1377224-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1377016-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\EventParameters | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1376794-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\BrokerId | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1376461-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1131103-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\EventType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1130895-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\EventType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1130641-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\EventType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1127058-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\ExtendedRegistrationData | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1126855-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\PackageFlags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1126656-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\PsmActivationType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1126456-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\PackageRelativeAppName | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1126248-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\TaskEntryPoint | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1126044-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\TriggerEvent | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1125837-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\Name | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1125626-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1125415-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\Conditions | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1125196-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\ActivationType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1124905-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1014773-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed svchost.exe (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1011033-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\UserSid | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1010799-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\PackageFullName | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1010590-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1010340-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\EventParameters | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1010109-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\BrokerId | extended sysmon telemetry | |
| 2026-04-16T17:00:59.1009822-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0791608-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\UserSid | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0791397-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\PackageFullName | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0791084-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0790865-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\EventParameters | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0790556-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\BrokerId | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0790100-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0577956-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\UserSid | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0577756-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\PackageFullName | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0577534-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0577324-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\EventParameters | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0577103-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\BrokerId | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0576798-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0351094-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0349844-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0348323-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0347927-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0326575-07:00 | Sysmon 13 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (SetValue) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\State | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0325996-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0325793-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (DeleteKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0325562-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0319991-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\EventType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0319795-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\EventType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0319602-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\EventType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0319405-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\ExtendedRegistrationData | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0319206-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\PackageFlags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0319011-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\PsmActivationType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0318811-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\PackageRelativeAppName | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0318604-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\TaskEntryPoint | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0318405-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\TriggerEvent | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0318201-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\Name | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0317996-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0317792-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\Conditions | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0317582-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\ActivationType | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0317280-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0193156-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed svchost.exe (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0190928-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\UserSid | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0190639-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\PackageFullName | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0187952-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0187749-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\EventParameters | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0187535-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\BrokerId | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0187277-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a} | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0086771-07:00 | Sysmon 17 | other | C:\Program Files\WindowsApps\AD2F1837.OMENCommandCenter_1101.2603.3.0_x64__v1... | OmenCommandCenterBackground.exe created pipe \HP.Omen.Features.Services.Games.Background.GamePerformanceStatics2 | extended sysmon telemetry | |
| 2026-04-16T17:00:59.0081914-07:00 | Sysmon 18 | other | C:\Program Files\HP\Overlay\OverlayHelper.exe | OverlayHelper.exe connected to pipe \HP.Omen.Features.Services.Games.Background.GamePerformanceStatics2 | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9994853-07:00 | Sysmon 10 | other | C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe | Code.exe accessed Code.exe (GrantedAccess 0x101401) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9981556-07:00 | Sysmon 18 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | powershell.EXE connected to pipe \{7FCB1218-D9DD-4E13-91C0-4EE04F8B8C90} | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9971626-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\UserSid | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9970667-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\PackageFullName | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9970214-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9969924-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\EventParameters | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9969633-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\BrokerId | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9969166-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45} | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9881594-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\UserSid | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9881343-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\PackageFullName | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9881072-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\Flags | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9880732-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\EventParameters | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9880484-07:00 | Sysmon 13 | other | C:\windows\system32\svchost.exe | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\BrokerId | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9880284-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345} | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9772269-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{5ef5dfb7-acb1-45a1-9e15-7f7a408bef14} | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9769424-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f247a6b9-6c24-437b-913a-f1fe9b8aec39} | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9767754-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{ee6c63ac-ec61-412f-85d1-2bcfb509220f} | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9766731-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{fef54999-0247-44ab-8281-b21e3eea1d1e} | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9739507-07:00 | Sysmon 13 | other | C:\Windows\System32\RuntimeBroker.exe | Registry change (SetValue) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Settings\SpotlightDis... | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9739199-07:00 | Sysmon 12 | other | C:\Windows\System32\RuntimeBroker.exe | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Settings | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9725387-07:00 | Sysmon 10 | other | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9707730-07:00 | Sysmon 18 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | powershell.EXE connected to pipe \{7FCB1218-D9DD-4E13-91C0-4EE04F8B8C90} | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9703050-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (DeleteKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9702745-07:00 | Sysmon 12 | other | C:\windows\system32\backgroundTaskHost.exe | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9668802-07:00 | Sysmon 10 | other | C:\windows\System32\svchost.exe | svchost.exe accessed powershell.EXE (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9662798-07:00 | Sysmon 10 | other | C:\windows\System32\svchost.exe | svchost.exe accessed powershell.EXE (GrantedAccess 0x1478) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9596310-07:00 | Sysmon 10 | other | C:\windows\system32\lsass.exe | lsass.exe accessed powershell.EXE (GrantedAccess 0x1478) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9595642-07:00 | Sysmon 10 | other | C:\windows\system32\lsass.exe | lsass.exe accessed powershell.EXE (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9469898-07:00 | Sysmon 17 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | powershell.EXE created pipe \PSHost.134208576588429941.32680.DefaultAppDomain.powershell | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9377932-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9377649-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9377339-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed powershell.EXE (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9376300-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed powershell.EXE (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9376017-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed wmiprvse.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9375690-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed wmiprvse.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9374547-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed python.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9374071-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed python.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9373241-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Windows Notepad Installer.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9372726-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Windows Notepad Installer.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9372049-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9371525-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9370782-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9370501-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9370095-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed CHXSmartScreen.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9368791-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed CHXSmartScreen.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9367487-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed smartscreen.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9367218-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed smartscreen.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9366945-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9366665-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9366382-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9366085-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9365443-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9363793-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9363524-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9363264-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9363003-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9362733-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9362472-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed wwahost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9362204-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed wwahost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9361947-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9361678-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9361425-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9361157-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9360889-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9360629-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9360362-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9360022-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9359756-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed BackgroundTaskHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9359480-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed BackgroundTaskHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9359163-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed AccountsControlHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9343503-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed AccountsControlHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9342905-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed wmiprvse.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9341810-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed wmiprvse.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9341532-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HPSystemEventUtilityHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9341252-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HPSystemEventUtilityHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9340959-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9340626-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9340353-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9340150-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9339946-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9339737-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9339529-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed LockApp.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9339245-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9339038-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9338826-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9338622-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9338413-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9338208-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9338001-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9337787-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed LockApp.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9337508-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9337300-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9337089-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9336884-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9336675-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9336465-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9336250-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9336039-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed TouchpointAnalyticsClient.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9335756-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9335552-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9335307-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed TouchpointAnalyticsClient.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9334903-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9334701-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9334496-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9334209-07:00 | Sysmon 26 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Deleted file detected: C:\Users\labuser\AppData\Local\Temp\__PSScriptPolicyTest_5odocrti.n3u.psm1 | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9333948-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9333690-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9333079-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed UserOOBEBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9332447-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed UserOOBEBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9332177-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9331915-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9331652-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9331389-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9331124-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9330859-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9330593-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9330327-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9330062-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9329793-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9329521-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9329227-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9325547-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9325196-07:00 | Sysmon 26 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Deleted file detected: C:\Users\labuser\AppData\Local\Temp\__PSScriptPolicyTest_nnlb2lxj.pim.ps1 | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9324929-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9324633-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed pwsh.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9323609-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed pwsh.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9322949-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9322371-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9321677-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9321181-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9320527-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed pet.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9320250-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed pet.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9319947-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed pwsh.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9319677-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed pwsh.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9319409-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9319133-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9318850-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9318570-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9318295-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9317992-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9317685-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9317403-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9317122-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9316830-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9316518-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9316224-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9315928-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9315076-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9314803-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Pub... | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9314568-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9314294-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9314024-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9313753-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9313480-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9313208-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9312926-07:00 | Sysmon 10 | other | C:\windows\System32\svchost.exe | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9312618-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9312349-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9312077-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ShellExperienceHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9311807-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ShellExperienceHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9311540-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ShellHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9311266-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ShellHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9310987-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9310711-07:00 | Sysmon 10 | other | C:\windows\System32\svchost.exe | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1478) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9310388-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9310110-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed AppActions.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9309835-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed AppActions.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9309545-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9309017-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9305180-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9304907-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9304622-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9304349-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9304069-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9303793-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bdtrackersnmh.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9303492-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9303077-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bdtrackersnmh.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9302802-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9302516-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9302233-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed cmd.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9301948-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9301494-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed cmd.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9301210-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9300934-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9300660-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9300385-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9300114-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9299837-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9299564-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9299288-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9299017-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9298742-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9298462-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9298183-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9297911-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ApplicationFrameHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9297636-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ApplicationFrameHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9297363-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9297088-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9296813-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9296534-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9296253-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HPEnhancedLighting.Bg.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9295973-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HPEnhancedLighting.Bg.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9295692-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9295416-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9295141-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9294857-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9294573-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9294288-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9294008-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9293730-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9293381-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9293051-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9292774-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9292495-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9292221-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9291943-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9291665-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9291386-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9291112-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9290838-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9290563-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9290285-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9290011-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed crashpad_handler.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9289730-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed crashpad_handler.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9289452-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9289178-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9288897-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ShureDeviceManager.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9288607-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ShureDeviceManager.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9288283-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9287799-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9287532-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9287264-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9286991-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9286724-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9286452-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9286175-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9285903-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RtkAudUService64.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9285627-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RtkAudUService64.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9285277-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x101000) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9284883-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9284611-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9284339-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HP.OMEN.VirtualCamHelper.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9284064-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HP.OMEN.VirtualCamHelper.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9283788-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed PhoneExperienceHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9283482-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed PhoneExperienceHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9283175-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ReconsentNotification.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9282897-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ReconsentNotification.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9282618-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9282343-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9282064-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed TextInputHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9281790-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed TextInputHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9281514-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HPMediaNetwork.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9281237-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HPMediaNetwork.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9280965-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Pub... | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9280748-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed unsecapp.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9280471-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed unsecapp.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9280197-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9279984-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9279772-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9279557-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HPSystemEventUtilityBackground.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9279265-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9279054-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9278838-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HPSystemEventUtilityBackground.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9278521-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9278314-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9278109-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9277898-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\trust | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9277692-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9277481-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9277274-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9277064-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\trust | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9276856-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\trust | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9276645-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\trust\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9276436-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\trust\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9276229-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\trust\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9276021-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\trust | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9275809-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\trust\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9275600-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\trust\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9275388-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\trust\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9275122-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\trust | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9274913-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\trust | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9274699-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9274484-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9274270-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9274028-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9272209-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9272002-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9271796-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9271586-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9271373-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9271166-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9270952-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9270741-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9270529-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9270321-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9270110-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9269902-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9269695-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9269478-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPeople | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9269268-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9269056-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9268844-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9268634-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPeople | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9268413-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPeople | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9268137-07:00 | Sysmon 10 | other | C:\windows\system32\sihost.exe | sihost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x101000) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9261755-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9261543-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9261328-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9261119-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\SmartCardRoot | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9260895-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9260675-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9260453-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9260240-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9260025-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9259809-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9259597-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9259378-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9259167-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9258947-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9258737-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9258521-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9258306-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9257802-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9257585-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9257360-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed OmenCommandCenterBackground.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9257049-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed OmenCommandCenterBackground.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9256738-07:00 | Sysmon 11 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | powershell.EXE created file C:\Users\labuser\AppData\Local\Temp\__PSScriptPolicyTest_5odocrti.n3u.psm1 | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9256459-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bdagent.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9255971-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bdagent.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9255697-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9255427-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9255153-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ctfmon.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9254882-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed ctfmon.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9254606-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9254339-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9254062-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9253850-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9253636-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9253421-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9253148-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9252934-07:00 | Sysmon 11 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | powershell.EXE created file C:\Users\labuser\AppData\Local\Temp\__PSScriptPolicyTest_nnlb2lxj.pim.ps1 | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9252706-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9252429-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9252148-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9251867-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9251590-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9251315-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9251099-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9250883-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9250668-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9250391-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9250114-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Root\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9249900-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Root\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9249685-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Root\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9249469-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9249193-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Root | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9248979-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9248700-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Root | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9248481-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9248199-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9247984-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9247700-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9247490-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9247277-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9247073-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9246857-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9246577-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9246367-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9246145-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9245858-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9245640-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9245400-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9244988-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9244353-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9244085-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9243885-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9243681-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9243471-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9243270-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9243011-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9242807-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9242591-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9242294-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9242090-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9241849-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9241578-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9241301-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9241089-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9240872-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed WidgetService.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9240599-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9240394-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9240184-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed WidgetService.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9239910-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9239700-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed StartMenuExperienceHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9239432-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed StartMenuExperienceHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9239163-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9238955-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9238752-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9238543-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed SearchHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9238273-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9238063-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9237855-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9237645-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed SearchHost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9237378-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9237173-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9236961-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\CA | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9236756-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9236545-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Widgets.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9236274-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9236062-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Widgets.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9235782-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9235509-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9235300-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\CA | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9235094-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9234824-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\CA | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9234613-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\CA\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9234404-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\CA\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9234193-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\CA\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9233982-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9233710-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\CA | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9233498-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9233226-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\CA\CTLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9233015-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\CA\CRLs | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9232802-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9232530-07:00 | Sysmon 18 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | powershell.EXE connected to pipe \{7FCB1218-D9DD-4E13-91C0-4EE04F8B8C90} | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9232305-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9232035-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed CrossDeviceService.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9231762-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\CA\Certificates | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9231548-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed CrossDeviceService.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9231273-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\CA | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9231053-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed CrossDeviceResume.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9230755-07:00 | Sysmon 12 | other | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\CA | certificate / WinTrust / PowerShell initialization noise | |
| 2026-04-16T17:00:58.9230502-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed CrossDeviceResume.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9230133-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed taskhostw.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9229668-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed taskhostw.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9229390-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Explorer.EXE (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9229105-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed Explorer.EXE (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9228775-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed DiscoverySrv.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9228481-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed DiscoverySrv.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9228102-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed SystemOptimizer.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9227426-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed SystemOptimizer.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9226837-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed OmenInstallMonitor.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9226549-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed OmenInstallMonitor.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9226145-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed OverlayHelper.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9225520-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed OverlayHelper.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9225251-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9224981-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9224709-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9224387-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9224120-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9223851-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9223587-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed sihost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9223306-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed sihost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9222995-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed nvcontainer.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9221810-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed nvcontainer.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9221541-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9221275-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9221012-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed nvcontainer.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9220746-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed nvcontainer.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9220476-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVDisplay.Container.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9220206-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NVDisplay.Container.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9219920-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed dwm.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9219653-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed dwm.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9219364-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed fontdrvhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9219006-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9218783-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9200224-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9199520-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed fontdrvhost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9199245-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9199032-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed WinLogon.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9198759-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed WinLogon.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9198489-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9198212-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9197947-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9197677-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9197409-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9197133-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9196762-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9196553-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9196344-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9196136-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9195907-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9195526-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9192950-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed TouchpointGpuInfo.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9192679-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed TouchpointGpuInfo.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9192407-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9192141-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9191876-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9191605-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9191340-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed dashost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9191080-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9190881-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9190683-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9190479-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed dashost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9190226-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9190024-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9189768-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9189506-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9189243-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9188984-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9188724-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9188465-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9188203-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9187938-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9187738-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9187537-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9187335-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9187128-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9186858-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9186593-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bdredline.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9186328-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bdredline.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9186060-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9185860-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9185661-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9185464-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9185256-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bdredline.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9184990-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bdredline.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9184725-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9184464-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9184202-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed SearchIndexer.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9183939-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed SearchIndexer.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9183683-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9183479-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9183278-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9183077-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9182843-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9182578-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9182318-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9182058-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9181800-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9181533-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9181225-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9180959-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9180679-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9180398-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9179944-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9146805-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9146547-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9146335-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NgcIso.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9146071-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9145870-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9145666-07:00 | Sysmon 12 | other | C:\windows\system32\svchost.exe | Registry change (CreateKey) HKLM\SOFTWARE | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9145426-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed NgcIso.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9145164-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9144898-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9144637-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9144375-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9144120-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9143856-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9143599-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9143340-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9143070-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9142806-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9142545-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bdntwrk.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9142282-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed bdntwrk.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9142018-07:00 | Sysmon 10 | other | C:\windows\system32\lsass.exe | lsass.exe accessed powershell.EXE (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9141662-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed AUDIODG.EXE (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9141401-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed AUDIODG.EXE (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9141135-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed unsecapp.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9140862-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed unsecapp.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9140590-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9140313-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9140037-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9139765-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9139485-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9139198-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9138924-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9138609-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9116117-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9115750-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9110384-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x100000) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9110073-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9109810-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1000) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9109503-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9109245-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed dashost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9108985-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed dashost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9108720-07:00 | Sysmon 10 | other | C:\windows\system32\svchost.exe | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x101000) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9108366-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed OfficeClickToRun.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9108097-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed OfficeClickToRun.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9107828-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9107564-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9107288-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed InstallerService.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9106886-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed InstallerService.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9104281-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HPCommRecovery.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9104021-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed HPCommRecovery.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9103762-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9103502-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9103249-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed XtuService.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9102995-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed XtuService.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9102738-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed updatesrv.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9102482-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed updatesrv.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9102225-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed WMIRegistrationService.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9101970-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed WMIRegistrationService.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9101714-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RtkAudUService64.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:58.9101452-07:00 | Sysmon 10 | other | C:\windows\system32\wbem\wmiprvse.exe | wmiprvse.exe accessed RtkAudUService64.exe (GrantedAccess 0x1400) | extended sysmon telemetry | |
| 2026-04-16T17:00:55.9913467-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T17:00:55.8250090-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | module / manifest / collector helper block | |
| 2026-04-16T17:00:55.6639409-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T17:00:55.5799072-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T17:00:55.4005734-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T17:00:55.2473216-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | module / manifest / collector helper block | |
| 2026-04-16T17:00:55.0903941-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T17:00:54.8801520-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T17:00:54.7776773-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T17:00:54.6181291-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T17:00:54.4611469-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | module / manifest / collector helper block | |
| 2026-04-16T17:00:54.2946294-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T17:00:49.0334156-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T17:00:48.9555284-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T17:00:48.7749048-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T17:00:48.6282033-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | module / manifest / collector helper block | |
| 2026-04-16T17:00:48.4683388-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T17:00:48.2688361-07:00 | PowerShell 4104 | scriptblock | powershell.exe | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | module / helper / collector script block | |
| 2026-04-16T17:00:48.2573382-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T17:00:48.1838464-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T17:00:48.0936266-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T17:00:48.0350454-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.9643617-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.8841439-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.8142641-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.7434358-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6601405-07:00 | PowerShell 4104 | scriptblock | powershell.exe | meterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6601329-07:00 | PowerShell 4104 | scriptblock | powershell.exe | lse { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'TrustLabelProtectionStatus'; ParameterType ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6601251-07:00 | PowerShell 4104 | scriptblock | powershell.exe | anagement.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6601186-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSurfaceReductionRules_Actions'; ParameterType = 'Microsoft.PowerShell.Cmdletization.Gener... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6601113-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ltAction'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdlet... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6601022-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ers.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6600957-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ll [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisablePrivacyMode')) { [object]$... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6600881-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $__cmdletization_value = ${SignatureUpdateCatchupInterval} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6600804-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ScanSched... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6600727-07:00 | PowerShell 4104 | scriptblock | powershell.exe | 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPrese... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6600649-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ${RemediationScheduleDay} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'RemediationScheduleDay'... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6600570-07:00 | PowerShell 4104 | scriptblock | powershell.exe | eNotNullOrEmpty()] [switch] ${EnableDnsSinkhole}, [Parameter(ParameterSetName='Remove2')] [Alias('dicf')] [ValidateNotNull()] ... | module / manifest / collector helper block | |
| 2026-04-16T17:00:47.6600504-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [Alias('sigui')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${SignatureUpdateInterval}, [Parameter(ParameterSetName='... | module / manifest / collector helper block | |
| 2026-04-16T17:00:47.6600438-07:00 | PowerShell 4104 | scriptblock | powershell.exe | cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionExclusions')) { [object]$__cmd... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6600364-07:00 | PowerShell 4104 | scriptblock | powershell.exe | clusionExtension')) { [object]$__cmdletization_value = ${ExclusionExtension} $__cmdletization_methodParameter = [Microsoft.PowerShell.C... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6600271-07:00 | PowerShell 4104 | scriptblock | powershell.exe | _cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6600190-07:00 | PowerShell 4104 | scriptblock | powershell.exe | on_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ScanScheduleOffset'; ParameterType = 'System.UInt32'; Bindings = 'In'; Val... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6600115-07:00 | PowerShell 4104 | scriptblock | powershell.exe | on.GeneratedTypes.MpPreference.UpdatesChannelType'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6600049-07:00 | PowerShell 4104 | scriptblock | powershell.exe | 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletiza... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6599983-07:00 | PowerShell 4104 | scriptblock | powershell.exe | rameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletizati... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6599916-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisableScanningMappedNetworkDrivesForFullScan')) { ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6599849-07:00 | PowerShell 4104 | scriptblock | powershell.exe | arameter]@{Name = 'RandomizeScheduleTaskTimes'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6599774-07:00 | PowerShell 4104 | scriptblock | powershell.exe | n_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('SignatureUpdateInterval'... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6599709-07:00 | PowerShell 4104 | scriptblock | powershell.exe | 'ScanScheduleQuickScanTime'; ParameterType = 'System.DateTime'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_def... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6599639-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Cmdletization.MethodParameter]@{Name = 'BruteForceProtectionSkipLearningPeriod'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6599553-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('R... | module / helper / collector script block | |
| 2026-04-16T17:00:47.6599474-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [bool] ${EnableDnsSinkhole}, [Parameter(ParameterSetName='Set0')] [Alias('dicf')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] ... | module / manifest / collector helper block | |
| 2026-04-16T17:00:47.6599390-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ation.GeneratedTypes.MpPreference.MAPSReportingType] ${MAPSReporting}, [Parameter(ParameterSetName='Set0')] [ValidateNotNull()] [Valida... | module / manifest / collector helper block | |
| 2026-04-16T17:00:47.6599307-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.4838839-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T17:00:47.3833529-07:00 | PowerShell 4104 | scriptblock | powershell.exe | +wRAgZfYPq2eAYYEjIwMjAwOTIyMjIxOTUwLjkzWjAEgAIB9KCB1KSB0TCBzjEL # MAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1v # bmQxHjAcBgNVBAoTFU1pY3... | module / helper / collector script block | |
| 2026-04-16T17:00:47.3833442-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | module / manifest / collector helper block | |
| 2026-04-16T17:00:47.2292631-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | module / helper / collector script block | |
| 2026-04-16T17:00:46.8992624-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | module / helper / collector script block | |
| 2026-04-16T17:00:46.8844235-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | module / helper / collector script block | |
| 2026-04-16T17:00:46.8655707-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T17:00:46.5973326-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T17:00:46.4124099-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.4124065-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.4124053-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.4124039-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.4124026-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.4124010-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.4123972-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.4123959-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.4123947-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.4123931-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.4123891-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.4123868-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T17:00:46.3715472-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | module / manifest / collector helper block | |
| 2026-04-16T17:00:46.2312159-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | module / helper / collector script block | |
| 2026-04-16T17:00:46.0887273-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | collector self-activity |
| 2026-04-16T17:00:45.9769673-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | collector self-activity |
| 2026-04-16T16:57:36.5034759-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:57:36.4960389-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe92_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T16:57:35.5030225-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8weky... | StoreDesktopExtension.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" ... | service/background parent or machine account |
| 2026-04-16T16:56:07.0709522-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\Taskmgr.exe | Taskmgr.exe <= Taskmgr.exe | "C:\windows\system32\taskmgr.exe" /4 | service/background parent or machine account |
| 2026-04-16T16:56:07.0034184-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\consent.exe | consent.exe <= svchost.exe | consent.exe 4976 452 0000025EA21BF430 | service/background parent or machine account |
| 2026-04-16T16:55:15.2638226-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T16:55:10.2046070-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T16:55:01.8076460-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:55:01.3312298-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe91_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T16:54:58.0755591-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:54:57.9054463-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartS... | CHXSmartScreen.exe <= svchost.exe | "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe" -ServerName:App.AppXk7vvv12h4qrk... | service/background parent or machine account |
| 2026-04-16T16:54:55.9663760-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T16:54:53.2541699-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T16:54:53.1794070-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T16:54:53.0681030-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T16:54:52.9933063-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T16:54:52.8392805-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | module / manifest / collector helper block | |
| 2026-04-16T16:54:52.6957228-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T16:54:52.6802533-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T16:54:52.5992550-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T16:54:52.4244479-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T16:54:52.2592652-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | module / manifest / collector helper block | |
| 2026-04-16T16:54:52.1214795-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T16:54:52.0751366-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T16:54:50.1586142-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T16:54:50.0903319-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T16:54:49.9144209-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T16:54:49.7615815-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | module / manifest / collector helper block | |
| 2026-04-16T16:54:49.6191155-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T16:54:49.6038144-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T16:54:49.5216086-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T16:54:49.3701452-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T16:54:49.2114975-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | module / manifest / collector helper block | |
| 2026-04-16T16:54:49.0714172-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T16:54:49.0553159-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T16:54:48.8751081-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T16:54:48.7733625-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T16:54:48.5972664-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T16:54:48.4324234-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | module / manifest / collector helper block | |
| 2026-04-16T16:54:48.2966356-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T16:54:48.2721138-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T16:54:43.1474309-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T16:54:43.0764929-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T16:54:42.8998156-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T16:54:42.7483318-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | module / manifest / collector helper block | |
| 2026-04-16T16:54:42.6058768-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T16:54:42.5863008-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T16:54:42.3982714-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T16:54:42.3858188-07:00 | PowerShell 4104 | scriptblock | powershell.exe | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | module / helper / collector script block | |
| 2026-04-16T16:54:42.3742620-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T16:54:42.2821027-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T16:54:42.1921319-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T16:54:42.1439848-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T16:54:42.0620634-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T16:54:41.9792497-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T16:54:41.9107061-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T16:54:41.8415764-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7822157-07:00 | PowerShell 4104 | scriptblock | powershell.exe | _methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSB... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7822099-07:00 | PowerShell 4104 | scriptblock | powershell.exe | cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AllowNetworkProtectionDownLevel'; ParameterType = 'System.Manag... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7821993-07:00 | PowerShell 4104 | scriptblock | powershell.exe | n_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defa... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7821899-07:00 | PowerShell 4104 | scriptblock | powershell.exe | rkScanningToIOAV} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ApplyDisableNetworkScanningToIO... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7821807-07:00 | PowerShell 4104 | scriptblock | powershell.exe | zation_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_meth... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7821715-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureFirstAuGracePeriod'; ParameterType = 'System.Manage... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7821625-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Aggressiveness} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'BruteForceProtectionAggressivenes... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7821535-07:00 | PowerShell 4104 | scriptblock | powershell.exe | {DisableQuicParsing}, [Parameter(ParameterSetName='Remove2')] [Alias('nprepmode')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] ... | module / manifest / collector helper block | |
| 2026-04-16T16:54:41.7821422-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ${BruteForceProtectionExclusions}, [Parameter(ParameterSetName='Remove2')] [Alias('bfplnb')] [ValidateNotNull()] [ValidateNotNullOrEmpt... | module / manifest / collector helper block | |
| 2026-04-16T16:54:41.7821331-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.M... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7821240-07:00 | PowerShell 4104 | scriptblock | powershell.exe | true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'EnableUdpSegmentationOffl... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7821123-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableSshParsing'; ParameterType = 'System.Boolean'; Bindin... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7821033-07:00 | PowerShell 4104 | scriptblock | powershell.exe | r) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7820709-07:00 | PowerShell 4104 | scriptblock | powershell.exe | me = 'DisableEmailScanning'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { ... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7820618-07:00 | PowerShell 4104 | scriptblock | powershell.exe | rs.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7820523-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ay'; ParameterType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} ... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7820426-07:00 | PowerShell 4104 | scriptblock | powershell.exe | etization.MethodParameter]@{Name = 'RemediationScheduleTime'; ParameterType = 'System.DateTime'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePres... | module / helper / collector script block | |
| 2026-04-16T16:54:41.7819983-07:00 | PowerShell 4104 | scriptblock | powershell.exe | dletization.GeneratedTypes.MpPreference.ASRRuleActionType] ${EnableNetworkProtection}, [Parameter(ParameterSetName='Set0')] [ValidateNotNull... | module / manifest / collector helper block | |
| 2026-04-16T16:54:41.7819845-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T16:54:41.5949681-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T16:54:41.4991211-07:00 | PowerShell 4104 | scriptblock | powershell.exe | RUQwzXTbg4CLNC3ZOs1nMwVyaCo0UN0Or1R4HNvyRgMlhgRvJYR4YyhB50 # YWeRX4FUsc+TTJLBxKZd0WETbijGGvmGgLvfYfxGwScdJGcSchohiq9LZIlQYrFd # /XcfPfBXday9ikJNQFHRD5wGPmd... | module / helper / collector script block | |
| 2026-04-16T16:54:41.4991126-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | module / manifest / collector helper block | |
| 2026-04-16T16:54:41.3474801-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | module / helper / collector script block | |
| 2026-04-16T16:54:41.0348135-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | module / helper / collector script block | |
| 2026-04-16T16:54:41.0193913-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | module / helper / collector script block | |
| 2026-04-16T16:54:40.9993538-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T16:54:40.7148542-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T16:54:40.5317423-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.5317410-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.5317397-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.5317362-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.5317349-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.5317336-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.5317323-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.5317309-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.5317275-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.5317262-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.5317247-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.5317224-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T16:54:40.4886580-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | module / manifest / collector helper block | |
| 2026-04-16T16:54:40.3497115-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | module / helper / collector script block | |
| 2026-04-16T16:54:40.2022995-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | collector self-activity |
| 2026-04-16T16:54:40.0869812-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | collector self-activity |
| 2026-04-16T16:54:01.5980532-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\Taskmgr.exe | Taskmgr.exe <= Taskmgr.exe | "C:\windows\system32\taskmgr.exe" /4 | service/background parent or machine account |
| 2026-04-16T16:54:01.5239378-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\consent.exe | consent.exe <= svchost.exe | consent.exe 4976 452 0000025EA21CB810 | service/background parent or machine account |
| 2026-04-16T16:52:59.4563707-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:52:27.9838169-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\smartscreen.exe | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:52:25.4748268-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US -... | browser helper/renderer noise |
| 2026-04-16T16:52:25.4748230-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US -... | browser helper/renderer noise |
| 2026-04-16T16:52:25.3599541-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T16:52:21.2985698-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T16:52:19.5059952-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T16:51:50.0290513-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:51:24.1595754-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} | service/background parent or machine account |
| 2026-04-16T16:51:24.1228950-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\rundll32.exe | rundll32.exe <= svchost.exe | "C:\windows\system32\rundll32.exe" "C:\windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsNotepad_8wekyb3d8bbwe | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T16:51:24.1042581-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\rundll32.exe | rundll32.exe <= svchost.exe | C:\windows\system32\rundll32.exe C:\windows\system32\AppXDeploymentExtensions.OneCore.dll,ShellRefresh | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T16:50:18.6483383-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:50:12.0626749-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\taskhostw.exe | taskhostw.exe <= svchost.exe | taskhostw.exe | service/background parent or machine account |
| 2026-04-16T16:50:01.4899535-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" | interactive parent: explorer.exe; service/background parent or machine account |
| 2026-04-16T16:49:52.7831648-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} | service/background parent or machine account |
| 2026-04-16T16:49:52.7459783-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\rundll32.exe | rundll32.exe <= svchost.exe | "C:\windows\system32\rundll32.exe" "C:\windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsNotepad_8wekyb3d8bbwe | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T16:49:52.7205886-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\rundll32.exe | rundll32.exe <= svchost.exe | C:\windows\system32\rundll32.exe C:\windows\system32\AppXDeploymentExtensions.OneCore.dll,ShellRefresh | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T16:49:38.2502547-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:49:31.6462221-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" | interactive parent: explorer.exe; service/background parent or machine account |
| 2026-04-16T16:49:29.0411201-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:49:27.9486348-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXe9cvj1thv1hmcw0cs98xm3r97tyzy2xs.mca | service/background parent or machine account |
| 2026-04-16T16:49:23.7137088-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wermgr.exe | wermgr.exe <= svchost.exe | "C:\windows\system32\wermgr.exe" -upload | service/background parent or machine account |
| 2026-04-16T16:48:58.8531879-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe90_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T16:48:58.0020803-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= sihost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" RestartByRestartManag... | service/background parent or machine account |
| 2026-04-16T16:48:57.4441623-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} | service/background parent or machine account |
| 2026-04-16T16:48:57.3962487-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\rundll32.exe | rundll32.exe <= svchost.exe | "C:\windows\system32\rundll32.exe" "C:\windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsNotepad_8wekyb3d8bbwe | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T16:48:57.2789032-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\rundll32.exe | rundll32.exe <= svchost.exe | C:\windows\system32\rundll32.exe C:\windows\system32\AppXDeploymentExtensions.OneCore.dll,ShellRefresh | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T16:48:33.9265091-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T16:48:11.5822957-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\WerFault.exe | WerFault.exe <= svchost.exe | werfault.exe /hc /shared Global\2676ec20dd6649989e9f9e8ab22fc014 /t 0 /p 30504 | service/background parent or machine account |
| 2026-04-16T16:48:11.5508854-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k WerSvcGroup | service/background parent or machine account |
| 2026-04-16T16:48:11.5487781-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= dllhost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | service/background parent or machine account |
| 2026-04-16T16:47:40.4989739-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | service/background parent or machine account |
| 2026-04-16T16:46:41.1769852-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:46:40.1829265-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T16:46:38.9961437-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F} | service/background parent or machine account |
| 2026-04-16T16:46:38.9708774-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} | service/background parent or machine account |
| 2026-04-16T16:46:38.5131026-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:46:38.4431093-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\WWAHost.exe | WWAHost.exe <= svchost.exe | "C:\WINDOWS\system32\wwahost.exe" -ServerName:App.wwa | service/background parent or machine account |
| 2026-04-16T16:46:20.2659746-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T16:45:58.8621757-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T16:45:53.7492851-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T16:45:51.2021201-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --... | browser helper/renderer noise |
| 2026-04-16T16:45:51.1088792-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --... | browser helper/renderer noise |
| 2026-04-16T16:45:48.7206976-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T16:45:48.6343898-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T16:45:21.0059366-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k LocalService -p -s WebClient | service/background parent or machine account |
| 2026-04-16T16:45:12.9453684-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost | service/background parent or machine account |
| 2026-04-16T16:45:11.9664639-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T16:45:11.2924487-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\smartscreen.exe | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:45:07.0987581-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:45:04.8231163-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T16:44:35.1038280-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:44:35.0627885-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T16:44:22.6746850-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | MicrosoftEdgeUpdate.exe <= svchost.exe | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler | service/background parent or machine account |
| 2026-04-16T16:42:42.8781321-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:42:42.7441483-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8weky... | StoreDesktopExtension.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" ... | service/background parent or machine account |
| 2026-04-16T16:42:42.6710300-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gj... | service/background parent or machine account |
| 2026-04-16T16:42:42.6637260-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8weky... | StoreDesktopExtension.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" ... | service/background parent or machine account |
| 2026-04-16T16:42:42.6413065-07:00 | Security 4688 | process | LAB-HOST$ | C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe | Zoom.exe <= svchost.exe | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule | service/background parent or machine account |
| 2026-04-16T16:42:27.3615257-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:42:27.3195331-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T16:42:27.1998728-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\taskhostw.exe | taskhostw.exe <= svchost.exe | taskhostw.exe | service/background parent or machine account |
| 2026-04-16T16:41:13.7319778-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControl... | AccountsControlHost.exe <= svchost.exe | "C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe" -ServerName:App.AppX20qnn98v... | service/background parent or machine account |
| 2026-04-16T16:39:07.8569895-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:39:07.8185586-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:39:05.6530114-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | service/background parent or machine account |
| 2026-04-16T16:38:40.2846011-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | service/background parent or machine account |
| 2026-04-16T16:38:30.7147828-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:38:30.6740076-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T16:38:30.6187079-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\BackgroundTransferHost.exe | BackgroundTransferHost.exe <= svchost.exe | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | service/background parent or machine account |
| 2026-04-16T16:38:30.5290370-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T16:38:30.5175234-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | service/background parent or machine account |
| 2026-04-16T16:38:30.5122605-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:38:30.4863445-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T16:38:30.4840779-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe | SDXHelper.exe <= svchost.exe | "C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding | service/background parent or machine account |
| 2026-04-16T16:38:30.4369556-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca | service/background parent or machine account |
| 2026-04-16T16:38:30.4218888-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca | service/background parent or machine account |
| 2026-04-16T16:38:30.3924024-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe | SDXHelper.exe <= svchost.exe | "C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe" /onlogon | service/background parent or machine account |
| 2026-04-16T16:38:30.3812804-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | service/background parent or machine account |
| 2026-04-16T16:38:30.3450379-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\UsoClient.exe | UsoClient.exe <= svchost.exe | "C:\windows\system32\usoclient.exe" StartWork | service/background parent or machine account |
| 2026-04-16T16:35:10.3197341-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ProcInfo.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provide... | service/background parent or machine account |
| 2026-04-16T16:34:32.1892039-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" | interactive parent: explorer.exe; service/background parent or machine account |
| 2026-04-16T16:33:33.8646263-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T16:32:48.0379780-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T16:32:44.3194144-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= sdbinst.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T16:32:44.3080737-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\sdbinst.exe | sdbinst.exe <= svchost.exe | C:\windows\System32\sdbinst.exe -m -bg | service/background parent or machine account |
| 2026-04-16T16:32:42.8313815-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T16:32:20.0584168-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\App... | interactive parent: explorer.exe; service/background parent or machine account |
| 2026-04-16T16:32:06.3740466-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DataExchangeHost.exe | DataExchangeHost.exe <= svchost.exe | C:\Windows\System32\DataExchangeHost.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:31:59.9616151-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\App... | interactive parent: explorer.exe; service/background parent or machine account |
| 2026-04-16T16:31:42.9458745-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --la... | VS Code / developer-tool helper activity |
| 2026-04-16T16:31:42.9426030-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\labuser\AppData\Roaming\... | VS Code / developer-tool helper activity |
| 2026-04-16T16:31:42.9031071-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\labuser\AppData\Roam... | VS Code / developer-tool helper activity |
| 2026-04-16T16:31:42.7398976-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe | Code.exe <= explorer.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\labuser\AppData\Local\Temp\1f836303-d3a9-4e23-9317-eb14... | VS Code / developer-tool helper activity |
| 2026-04-16T16:30:58.8624927-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T16:30:53.2810310-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --la... | VS Code / developer-tool helper activity |
| 2026-04-16T16:30:53.2773053-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\labuser\AppData\Roaming\... | VS Code / developer-tool helper activity |
| 2026-04-16T16:30:53.2348280-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\labuser\AppData\Roam... | VS Code / developer-tool helper activity |
| 2026-04-16T16:30:53.0685406-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe | Code.exe <= explorer.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\labuser\Downloads\GITHUB_PREVIEW.md" | VS Code / developer-tool helper activity |
| 2026-04-16T16:30:53.0294060-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\smartscreen.exe | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:30:48.6119803-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:30:31.6871292-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:30:30.9900811-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchFilterHost.exe | SearchFilterHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchFilterHost.exe" 932 3788 3824 916 {5E941D80-BF96-11CD-B579-08002B30BFEB} | service/background parent or machine account |
| 2026-04-16T16:30:30.5265825-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T16:30:30.5108564-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T16:30:30.4923131-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T16:30:30.4717360-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T16:30:27.4274357-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T16:30:27.4181979-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | service/background parent or machine account |
| 2026-04-16T16:30:23.1833828-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchFilterHost.exe | SearchFilterHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchFilterHost.exe" 932 3248 3932 916 {3B224B11-9363-407E-850F-C9E1FFACD8FB} | service/background parent or machine account |
| 2026-04-16T16:30:23.1466650-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe89_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T16:30:23.0617351-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T16:30:22.8046988-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:30:22.3228558-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-U... | browser helper/renderer noise |
| 2026-04-16T16:29:18.2705075-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:29:18.2344647-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:29:16.0610917-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | service/background parent or machine account |
| 2026-04-16T16:28:27.4114025-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:28:27.3714270-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T16:28:27.2499555-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T16:28:27.2245575-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | service/background parent or machine account |
| 2026-04-16T16:28:27.1306730-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | service/background parent or machine account |
| 2026-04-16T16:24:00.4018472-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\taskhostw.exe | taskhostw.exe <= svchost.exe | taskhostw.exe -flow showtoast -checkup recoverability | service/background parent or machine account |
| 2026-04-16T16:23:40.0016595-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SecurityHealth\10.0.29554.1001-0\SecurityHealthHost.exe | SecurityHealthHost.exe <= svchost.exe | \\?\C:\Windows\System32\SecurityHealth\10.0.29554.1001-0\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A... | command line matches suspicious/admin patterns; service/background parent or machine account |
| 2026-04-16T16:23:30.0564523-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:23:30.0102167-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T16:23:30.0088299-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\taskhostw.exe | taskhostw.exe <= svchost.exe | taskhostw.exe | service/background parent or machine account |
| 2026-04-16T16:23:29.9258947-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T16:23:29.9253807-07:00 | Security 4688 | process | labuser | C:\Program Files\WindowsApps\AD2F1837.HPSystemEventUtility_3.2.16.0_x64__v10z... | HPSystemEventUtilityHost.exe <= HPSystemEventUtilityBackground.exe | "C:\Program Files\WindowsApps\AD2F1837.HPSystemEventUtility_3.2.16.0_x64__v10z8vjag6ke6\... | interactive user account |
| 2026-04-16T16:23:29.9108358-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k CameraMonitor | service/background parent or machine account |
| 2026-04-16T16:23:29.8926218-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\taskhostw.exe | taskhostw.exe <= svchost.exe | taskhostw.exe KEYROAMING | service/background parent or machine account |
| 2026-04-16T16:23:23.9080730-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:23:23.8692927-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T16:23:21.7455965-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\ctfmon.exe | ctfmon.exe <= svchost.exe | /QuitInfo:00000000000003B4;00000000000003F0; | service/background parent or machine account |
| 2026-04-16T16:23:21.6935919-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | service/background parent or machine account |
| 2026-04-16T16:20:32.2326481-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T16:20:31.8862740-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T16:20:31.8556832-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | service/background parent or machine account |
| 2026-04-16T16:20:31.8009538-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T16:20:31.7704820-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal | service/background parent or machine account |
| 2026-04-16T16:20:31.7213147-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T16:20:31.6838692-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= svchost.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system | service/background parent or machine account |
| 2026-04-16T16:20:01.8781306-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T16:20:01.8463303-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | service/background parent or machine account |
| 2026-04-16T16:19:52.0074613-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T16:19:51.9773921-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal | service/background parent or machine account |
| 2026-04-16T16:19:51.9354332-07:00 | Security 4688 | process | labuser | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | interactive user account |
| 2026-04-16T16:19:51.8999576-07:00 | Security 4688 | process | labuser | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system | interactive user account |
| 2026-04-16T16:19:51.8660853-07:00 | Security 4688 | process | labuser | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | interactive user account |
| 2026-04-16T16:19:51.8272970-07:00 | Security 4688 | process | labuser | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= chrome.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake-all --system | browser updater / maintenance activity |
| 2026-04-16T16:19:51.7639641-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T16:19:51.7314168-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | service/background parent or machine account |
| 2026-04-16T16:19:45.5665592-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T16:19:45.5396226-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=patch.mojom.FilePatcher --lang=en-US --s... | browser helper/renderer noise |
| 2026-04-16T16:19:45.5210532-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T16:19:33.2437302-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k netsvcs -p -s BITS | service/background parent or machine account |
| 2026-04-16T16:18:33.8033104-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T16:18:02.8850487-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T16:15:58.9030302-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T16:15:58.8969041-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T16:10:47.8808061-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Bitdefender\Bitdefender Security\vulnerability.scan.exe | vulnerability.scan.exe <= bdservicehost.exe | --hosts-verifier --start --proxy= --proxy-authentication= | service/background parent or machine account |
| 2026-04-16T16:03:33.7485670-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T16:00:58.8536619-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T15:59:04.9057498-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k defragsvc | service/background parent or machine account |
| 2026-04-16T15:59:04.8872308-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= Defrag.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:59:04.8812373-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\Defrag.exe | Defrag.exe <= svchost.exe | "C:\windows\system32\defrag.exe" -p 11f0 -s 0000000000000474 -b -OnlyPreferred C: | service/background parent or machine account |
| 2026-04-16T15:59:04.5436279-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:59:04.4987511-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T15:59:04.3653796-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T15:59:04.3161367-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | service/background parent or machine account |
| 2026-04-16T15:59:04.2232462-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | service/background parent or machine account |
| 2026-04-16T15:55:01.0947064-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca | service/background parent or machine account |
| 2026-04-16T15:55:00.9451087-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:55:00.7817637-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe | LockApp.exe <= svchost.exe | "C:\windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe" -ServerName:WindowsDefaultLockScreen.AppX7y4nbzq37zn4ks9k7am... | service/background parent or machine account |
| 2026-04-16T15:55:00.7272572-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k CameraMonitor | service/background parent or machine account |
| 2026-04-16T15:55:00.7174699-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\taskhostw.exe | taskhostw.exe <= svchost.exe | taskhostw.exe KEYROAMING | service/background parent or machine account |
| 2026-04-16T15:55:00.6607517-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\LogonUI.exe | LogonUI.exe <= winlogon.exe | "LogonUI.exe" /flags:0x0 /state0:0xa08da855 /state1:0x41c64e6d | service/background parent or machine account |
| 2026-04-16T15:54:58.5059876-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:54:58.4602053-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T15:53:15.8903364-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ProcInfo.exe <= TouchpointAnalyticsClient.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data ... | service/background parent or machine account |
| 2026-04-16T15:52:58.4373534-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T15:52:37.0491337-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:52:33.7834310-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= w32tm.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:52:33.7710133-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\w32tm.exe | w32tm.exe <= TouchpointAnalyticsClient.exe | "C:\windows\system32\w32tm.exe" /query /status /verbose | service/background parent or machine account |
| 2026-04-16T15:52:27.0949700-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= netsh.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:52:27.0860237-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\netsh.exe | netsh.exe <= TouchpointAnalyticsClient.exe | "C:\windows\system32\netsh.exe" wlan show interfaces | service/background parent or machine account |
| 2026-04-16T15:52:16.3190649-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\powercfg.exe | powercfg.exe <= cmd.exe | powercfg /sleepstudy /output "C:\ProgramData\HP\HP Touchpoint Analytics Client\Provider Data\DeviceOnlineTime\Sleepxml.xml" /xml /... | interactive parent: cmd.exe; service/background parent or machine account |
| 2026-04-16T15:52:16.3013747-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= cmd.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | console host child of interactive shell |
| 2026-04-16T15:52:16.2907765-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\cmd.exe | cmd.exe <= TouchpointAnalyticsClient.exe | "C:\windows\system32\cmd.exe" "/C powercfg /sleepstudy /output "C:\ProgramData\HP\HP Touchpoint Analytics Client\P... | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T15:52:16.2182040-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= sigcheck.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:52:16.2082560-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | sigcheck.exe <= TouchpointAnalyticsClient.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data ... | service/background parent or machine account |
| 2026-04-16T15:52:16.1210982-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= sigcheck.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:52:16.1059121-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | sigcheck.exe <= TouchpointAnalyticsClient.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data ... | service/background parent or machine account |
| 2026-04-16T15:52:15.8005783-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:52:15.7894957-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ETD_GetSMART.exe <= TouchpointAnalyticsClient.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider D... | service/background parent or machine account |
| 2026-04-16T15:51:10.9667122-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= schtasks.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:51:10.9515104-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\schtasks.exe | schtasks.exe <= TouchpointAnalyticsClient.exe | "C:\windows\system32\schtasks.exe" /Change /TN "Hewlett-Packard\HP Active Health\HP Active Health Scan" /DISABLE | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T15:49:09.6357116-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | TouchpointAnalyticsClient.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c1... | service/background parent or machine account |
| 2026-04-16T15:48:33.6822336-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T15:45:58.8851110-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:45:58.8427676-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T15:45:58.8369491-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXpybpk6fj2fe0gb0jan49e6dncngk3pa1.mca | service/background parent or machine account |
| 2026-04-16T15:45:52.9505217-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T15:45:28.5175562-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\rundll32.exe | rundll32.exe <= svchost.exe | "C:\windows\system32\rundll32.exe" C:\windows\system32\PcaSvc.dll,PcaPatchSdbTask | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T15:45:11.3823797-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:45:11.3715302-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | service/background parent or machine account |
| 2026-04-16T15:45:10.9290368-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:44:22.6751436-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | MicrosoftEdgeUpdate.exe <= svchost.exe | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler | service/background parent or machine account |
| 2026-04-16T15:44:11.9079297-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T15:43:56.7611424-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T15:42:42.6488422-07:00 | Security 4688 | process | LAB-HOST$ | C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe | Zoom.exe <= svchost.exe | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule | service/background parent or machine account |
| 2026-04-16T15:42:20.8698735-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:42:20.6774228-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T15:42:20.6619443-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca | service/background parent or machine account |
| 2026-04-16T15:42:20.6393847-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gj... | service/background parent or machine account |
| 2026-04-16T15:40:06.8012438-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T15:40:01.7170590-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T15:40:01.6954875-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | browser helper/renderer noise |
| 2026-04-16T15:40:01.6819006-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | browser helper/renderer noise |
| 2026-04-16T15:40:01.6502837-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\smartscreen.exe | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:39:13.9503407-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T15:39:13.5009390-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe88_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T15:39:07.8651981-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:39:01.5638846-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:39:01.4958588-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:39:01.3412747-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:39:01.2038058-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -E... | module / manifest / collector helper block | |
| 2026-04-16T15:39:01.0505911-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:39:01.0357662-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:39:00.9474009-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:39:00.8038004-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:39:00.6739654-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | module / manifest / collector helper block | |
| 2026-04-16T15:39:00.5375990-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:39:00.4967943-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:38:58.4877129-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:38:58.4122837-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:38:58.2404537-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:38:58.1336049-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logNam... | module / manifest / collector helper block | |
| 2026-04-16T15:38:57.9793844-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:38:57.9646991-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:38:57.8824584-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:38:57.7146722-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:38:57.5670930-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $... | module / manifest / collector helper block | |
| 2026-04-16T15:38:57.4113847-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:38:57.3961797-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:38:57.2014538-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:38:57.0976034-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:38:56.9180699-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:38:56.7692045-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | module / manifest / collector helper block | |
| 2026-04-16T15:38:56.6291924-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:38:56.5932185-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:38:44.0013351-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:38:43.9337764-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:38:43.7752844-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:38:43.6194931-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | module / manifest / collector helper block | |
| 2026-04-16T15:38:43.4786521-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:38:43.4594789-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:38:43.3060088-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T15:38:43.2948086-07:00 | PowerShell 4104 | scriptblock | powershell.exe | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | module / helper / collector script block | |
| 2026-04-16T15:38:43.2835343-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:38:43.2211229-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:38:43.1332849-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:38:43.0752179-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:38:42.9933871-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:38:42.9077424-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:38:42.8607818-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7908310-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7126569-07:00 | PowerShell 4104 | scriptblock | powershell.exe | _value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = ... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7126489-07:00 | PowerShell 4104 | scriptblock | powershell.exe | leDnsSinkhole')) { [object]$__cmdletization_value = ${EnableDnsSinkhole} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdle... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7126411-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ion_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ProxyServer'; ParameterType = 'System.Management.Automation.SwitchParamet... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7126316-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ameters.ContainsKey('PUAProtection')) { [object]$__cmdletization_value = ${PUAProtection} $__cmdletization_methodParameter = [Microsoft... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7126234-07:00 | PowerShell 4104 | scriptblock | powershell.exe | } } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null ... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7126149-07:00 | PowerShell 4104 | scriptblock | powershell.exe | n.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = ... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7126072-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ject]$__cmdletization_value = ${SignatureFallbackOrder} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{N... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7125963-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ion_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7125872-07:00 | PowerShell 4104 | scriptblock | powershell.exe | n_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionConfiguredState')) { [object]$__cmdletizat... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7125767-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [Parameter(ParameterSetName='Remove2')] [Alias('dgr')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${DisableGradualRelea... | module / manifest / collector helper block | |
| 2026-04-16T15:38:42.7125680-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ScanPurgeItemsAfterDelay}, [Parameter(ParameterSetName='Remove2')] [Alia... | module / manifest / collector helper block | |
| 2026-04-16T15:38:42.7125569-07:00 | PowerShell 4104 | scriptblock | powershell.exe | methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ControlledFolderAccessAllowedApplications'; ParameterType = 'System.String[]'... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7125485-07:00 | PowerShell 4104 | scriptblock | powershell.exe | bleCoreServiceECSIntegration'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_de... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7125376-07:00 | PowerShell 4104 | scriptblock | powershell.exe | rs.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7125281-07:00 | PowerShell 4104 | scriptblock | powershell.exe | aultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisableSshParsing')) { [object]$__cmdletization_value = ${DisableSshParsi... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7125187-07:00 | PowerShell 4104 | scriptblock | powershell.exe | em.String[]'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdleti... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7125102-07:00 | PowerShell 4104 | scriptblock | powershell.exe | alue = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__c... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7124814-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ization.MethodParameter]@{Name = 'DisableIntrusionPreventionSystem'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_defaultValue... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7124715-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ]@{Name = 'SignatureUpdateInterval'; ParameterType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletizati... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7124295-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodP... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7124191-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Value = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('BruteForceProtectionMaxBlockTime'... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7124099-07:00 | PowerShell 4104 | scriptblock | powershell.exe | lassName, $script:ClassVersion, $script:ModuleVersion, $script:PrivateData) if ($__cmdletization_objectModelWrapper -is [System.Management... | module / helper / collector script block | |
| 2026-04-16T15:38:42.7124005-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [Parameter(ParameterSetName='Set0')] [Alias('demsc')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${DisableEmailScanning},... | module / manifest / collector helper block | |
| 2026-04-16T15:38:42.7123855-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:38:42.5112243-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:38:42.4144677-07:00 | PowerShell 4104 | scriptblock | powershell.exe | jAxMS0w # Ny0wOC5jcmwwYQYIKwYBBQUHAQEEVTBTMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3 # Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY0NvZFNpZ1BDQTIwMTFfMjAx # MS0wNy0wOC... | module / helper / collector script block | |
| 2026-04-16T15:38:42.4144551-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | module / manifest / collector helper block | |
| 2026-04-16T15:38:42.2495742-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | module / helper / collector script block | |
| 2026-04-16T15:38:41.9132615-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | module / helper / collector script block | |
| 2026-04-16T15:38:41.8981122-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | module / helper / collector script block | |
| 2026-04-16T15:38:41.8784416-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:38:41.6156590-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:38:41.4467307-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4467294-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4467282-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4467224-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4467170-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4467158-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4467145-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4467132-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4467098-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4467085-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4467070-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4467049-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:38:41.4025246-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | module / manifest / collector helper block | |
| 2026-04-16T15:38:41.2531802-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | module / helper / collector script block | |
| 2026-04-16T15:38:41.1177133-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | collector self-activity |
| 2026-04-16T15:38:41.0058931-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 7 --max-events 2000 --ou... | collector self-activity |
| 2026-04-16T15:35:48.1110287-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:35:48.1024429-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T15:35:09.4832630-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ProcInfo.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provide... | service/background parent or machine account |
| 2026-04-16T15:33:33.6094139-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T15:32:44.1847145-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= sdbinst.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:32:44.1756506-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\sdbinst.exe | sdbinst.exe <= svchost.exe | C:\windows\System32\sdbinst.exe -m -bg | service/background parent or machine account |
| 2026-04-16T15:31:44.4576785-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\BackgroundTransferHost.exe | BackgroundTransferHost.exe <= svchost.exe | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | service/background parent or machine account |
| 2026-04-16T15:31:44.3796905-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | service/background parent or machine account |
| 2026-04-16T15:31:44.3730603-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:31:44.2978216-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca | service/background parent or machine account |
| 2026-04-16T15:31:21.2919838-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T15:31:05.0265815-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T15:30:58.8448038-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T15:30:48.1013204-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:30:48.0934552-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T15:30:05.3153373-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:28:42.2177841-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T15:28:37.1374859-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T15:28:37.1143360-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | browser helper/renderer noise |
| 2026-04-16T15:28:37.1001856-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | browser helper/renderer noise |
| 2026-04-16T15:28:37.0687997-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\smartscreen.exe | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:28:11.8313638-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T15:28:06.1351668-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:28:03.3609563-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:28:03.2934563-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:28:03.1437757-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:28:02.9871961-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | module / manifest / collector helper block | |
| 2026-04-16T15:28:02.8448259-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:28:02.8304005-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:28:02.7465845-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:28:02.5679016-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:28:02.4023699-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | module / manifest / collector helper block | |
| 2026-04-16T15:28:02.2724326-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:28:02.2332472-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:28:00.2971108-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:28:00.2240215-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:28:00.0689998-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:27:59.9252721-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | module / manifest / collector helper block | |
| 2026-04-16T15:27:59.7764014-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:27:59.7616257-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:27:59.6777480-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:27:59.5041027-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:27:59.3492868-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | module / manifest / collector helper block | |
| 2026-04-16T15:27:59.2048675-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:27:59.1890505-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:27:58.9941185-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:27:58.8924793-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:27:58.7137406-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:27:58.5510397-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | module / manifest / collector helper block | |
| 2026-04-16T15:27:58.4179367-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:27:58.3934395-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:27:53.2744853-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:27:53.2080560-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:27:53.0590413-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:27:52.9238317-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | module / manifest / collector helper block | |
| 2026-04-16T15:27:52.7880344-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:27:52.7696071-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:27:52.6385843-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T15:27:52.6271163-07:00 | PowerShell 4104 | scriptblock | powershell.exe | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.6147358-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.5520658-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.4923343-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.4334450-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.3509952-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.2718833-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.2175583-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.1485464-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0862655-07:00 | PowerShell 4104 | scriptblock | powershell.exe | tion.MethodParameter]@{Name = 'RemoveScanningThreadPoolCap'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdl... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0862607-07:00 | PowerShell 4104 | scriptblock | powershell.exe | zation_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0862529-07:00 | PowerShell 4104 | scriptblock | powershell.exe | oft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableDnsOverTcpParsing'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0862450-07:00 | PowerShell 4104 | scriptblock | powershell.exe | plications'; ParameterType = 'System.String[]'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdl... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0862371-07:00 | PowerShell 4104 | scriptblock | powershell.exe | rameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defau... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0862286-07:00 | PowerShell 4104 | scriptblock | powershell.exe | alueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisableBehaviorMonitoring')) { [object]$__cmdletization_value = ${DisableBehav... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0862204-07:00 | PowerShell 4104 | scriptblock | powershell.exe | .Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletizati... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0862131-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0862058-07:00 | PowerShell 4104 | scriptblock | powershell.exe | alue; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'B... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0861968-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ValidateNotNullOrEmpty()] [switch] ${RemoveScanningThreadPoolCap}, [Parameter(ParameterSetName='Remove2')] [Alias('dcsei')] [Valid... | module / manifest / collector helper block | |
| 2026-04-16T15:27:52.0861872-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [Parameter(ParameterSetName='Remove2')] [Alias('ddtgp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${DisableDatagramPr... | module / manifest / collector helper block | |
| 2026-04-16T15:27:52.0861728-07:00 | PowerShell 4104 | scriptblock | powershell.exe | _cmdletization_value = ${AttackSurfaceReductionRules_RuleSpecificExclusions_Id} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletiza... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0861651-07:00 | PowerShell 4104 | scriptblock | powershell.exe | eneratedTypes.MpPreference.ThreatAction[]] ${ThreatIDDefaultAction_Actions}, [Parameter(ParameterSetName='Add1')] [ValidateNotNull()] [... | module / manifest / collector helper block | |
| 2026-04-16T15:27:52.0861574-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'NetworkProtectionReputationMode'; ParameterType = 'System.UI... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0861492-07:00 | PowerShell 4104 | scriptblock | powershell.exe | esent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [objec... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0861411-07:00 | PowerShell 4104 | scriptblock | powershell.exe | es_Actions} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSurfaceReductionRules_Actions';... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0861333-07:00 | PowerShell 4104 | scriptblock | powershell.exe | uePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [o... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0861042-07:00 | PowerShell 4104 | scriptblock | powershell.exe | hell.Cmdletization.MethodParameter]@{Name = 'DisableRealtimeMonitoring'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_defaultV... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0860965-07:00 | PowerShell 4104 | scriptblock | powershell.exe | n_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureBlobFileSharesSources'; ParameterType = 'System.String'; Bindings ... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0860501-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('ScanSched... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0860405-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('B... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0860305-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { __cmdletization_BindCommonParameters $__cmdletization_objectModelWrapper $PSBoundParameters $__cmdletization_objectModelWrapper.B... | module / helper / collector script block | |
| 2026-04-16T15:27:52.0860206-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ${DisableRemovableDriveScanning}, [Parameter(ParameterSetName='Set0')] [Alias('drp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] ... | module / manifest / collector helper block | |
| 2026-04-16T15:27:52.0860054-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:27:51.8793640-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:27:51.7881170-07:00 | PowerShell 4104 | scriptblock | powershell.exe | C/je3bpUpjtxpEyqUqtPc30wEg/rO9vmKmqKoLPT37svc2NV # BmGNl+85qO4fV/w7Cx7J0Bbqk19KcRNdjt6eKoTnTPHBHlVHQIHZpMxacbFOAkJr # qAVkYZdz7ikNXTxV+GRb36tC4ByMNxE2DF7vF... | module / helper / collector script block | |
| 2026-04-16T15:27:51.7881046-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | module / manifest / collector helper block | |
| 2026-04-16T15:27:51.6616137-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | module / helper / collector script block | |
| 2026-04-16T15:27:51.3361798-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | module / helper / collector script block | |
| 2026-04-16T15:27:51.3193035-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | module / helper / collector script block | |
| 2026-04-16T15:27:51.3004843-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:27:51.0223297-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:27:50.8730386-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8730373-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8730332-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8730319-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8730306-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8730293-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8730255-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8730243-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8730230-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8730216-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8730198-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8730147-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:27:50.8309063-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | module / manifest / collector helper block | |
| 2026-04-16T15:27:50.6750389-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | module / helper / collector script block | |
| 2026-04-16T15:27:50.5378417-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | collector self-activity |
| 2026-04-16T15:27:50.4294026-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | collector self-activity |
| 2026-04-16T15:27:10.7546431-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T15:27:10.7228380-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T15:27:10.1677784-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe87_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T15:25:48.0923638-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:25:48.0840823-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T15:21:47.6214482-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T15:21:19.0273515-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T15:21:18.5616343-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T15:20:48.0782810-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:20:48.0667250-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T15:20:32.4273340-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T15:20:32.3935136-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | service/background parent or machine account |
| 2026-04-16T15:20:32.3311367-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T15:20:32.2965747-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal | service/background parent or machine account |
| 2026-04-16T15:20:32.2432748-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T15:20:32.2372815-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T15:20:32.1977279-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= svchost.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system | service/background parent or machine account |
| 2026-04-16T15:18:33.5517162-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T15:18:12.7876101-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T15:18:07.7013263-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T15:18:07.6740247-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | browser helper/renderer noise |
| 2026-04-16T15:18:07.6581915-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | browser helper/renderer noise |
| 2026-04-16T15:18:07.6256397-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\smartscreen.exe | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:17:51.1044870-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T15:17:45.4925767-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:17:42.7233249-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:17:42.6562689-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:17:42.4844085-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:17:42.3380595-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | module / manifest / collector helper block | |
| 2026-04-16T15:17:42.1923305-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:17:42.1783242-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:17:42.0955881-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:17:41.9236645-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:17:41.7807283-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | module / manifest / collector helper block | |
| 2026-04-16T15:17:41.6451729-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:17:41.6043550-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:17:39.6723708-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:17:39.6006529-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:17:39.4418893-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:17:39.2929344-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | module / manifest / collector helper block | |
| 2026-04-16T15:17:39.1481344-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:17:39.1338088-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:17:39.0525099-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:17:38.8745586-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:17:38.7295316-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | module / manifest / collector helper block | |
| 2026-04-16T15:17:38.5910363-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:17:38.5760636-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:17:38.3865912-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:17:38.2858850-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:17:38.1058817-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:17:37.9978396-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | module / manifest / collector helper block | |
| 2026-04-16T15:17:37.8561873-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:17:37.8319673-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:17:32.5623702-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T15:17:32.4919257-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:17:32.3088692-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:17:32.1630113-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | module / manifest / collector helper block | |
| 2026-04-16T15:17:32.0244970-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T15:17:32.0050573-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T15:17:31.8214755-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T15:17:31.8092992-07:00 | PowerShell 4104 | scriptblock | powershell.exe | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.7980082-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.7092271-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.6205205-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.5733356-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.5163935-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.4423369-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.3726159-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.3034313-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2208259-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Parameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSurfaceReductionRules_RuleSpecificExclusions'; ParameterType = 'System.String... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2208182-07:00 | PowerShell 4104 | scriptblock | powershell.exe | PSBoundParameters.ContainsKey('AllowDatagramProcessingOnWinServer')) { [object]$__cmdletization_value = ${AllowDatagramProcessingOnWinServer} ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2208101-07:00 | PowerShell 4104 | scriptblock | powershell.exe | _value = ${EnableFileHashComputation} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'EnableFileH... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2208019-07:00 | PowerShell 4104 | scriptblock | powershell.exe | mdletization.MethodParameter]@{Name = 'UnknownThreatDefaultAction'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2207939-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ainsKey('DisableIntrusionPreventionSystem')) { [object]$__cmdletization_value = ${DisableIntrusionPreventionSystem} $__cmdletization_me... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2207857-07:00 | PowerShell 4104 | scriptblock | powershell.exe | er = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureScheduleTime'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bi... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2207758-07:00 | PowerShell 4104 | scriptblock | powershell.exe | gnaturesBeforeRunningScan')) { [object]$__cmdletization_value = ${CheckForSignaturesBeforeRunningScan} $__cmdletization_methodParameter... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2207675-07:00 | PowerShell 4104 | scriptblock | powershell.exe | esent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionConfiguredState')) { [object]$__cmdletization_value = ${Remo... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2207590-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ProxyPacUrl}, [Parameter(ParameterSetName='Remove2')] [Alias('pro... | module / manifest / collector helper block | |
| 2026-04-16T15:17:31.2207506-07:00 | PowerShell 4104 | scriptblock | powershell.exe | dateNotNullOrEmpty()] [string[]] ${ExclusionExtension}, [Parameter(ParameterSetName='Remove2')] [ValidateNotNull()] [ValidateNotNu... | module / manifest / collector helper block | |
| 2026-04-16T15:17:31.2207418-07:00 | PowerShell 4104 | scriptblock | powershell.exe | em.String[]'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdleti... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2207338-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultVal... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2207238-07:00 | PowerShell 4104 | scriptblock | powershell.exe | = 'DefinitionUpdatesChannel'; ParameterType = 'Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.DefinitionUpdatesChannelType'; Bindings = 'In';... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2207147-07:00 | PowerShell 4104 | scriptblock | powershell.exe | lueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2207056-07:00 | PowerShell 4104 | scriptblock | powershell.exe | 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.A... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2206961-07:00 | PowerShell 4104 | scriptblock | powershell.exe | andomizeScheduleTaskTimes')) { [object]$__cmdletization_value = ${RandomizeScheduleTaskTimes} $__cmdletization_methodParameter = [Micro... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2206863-07:00 | PowerShell 4104 | scriptblock | powershell.exe | odParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundP... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2206754-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ter]@{Name = 'ReportingCriticalFailureTimeOut'; ParameterType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2206644-07:00 | PowerShell 4104 | scriptblock | powershell.exe | lue; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'Ex... | module / helper / collector script block | |
| 2026-04-16T15:17:31.2206528-07:00 | PowerShell 4104 | scriptblock | powershell.exe | et0')] [Alias('mtdefac')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.... | module / manifest / collector helper block | |
| 2026-04-16T15:17:31.2206414-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:17:31.0030801-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T15:17:30.9105569-07:00 | PowerShell 4104 | scriptblock | powershell.exe | UEBhMC # VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV # BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEpMCcGA1UECxMgTWljcm9zb2Z0IE9w # ZXJhdGlvbnM... | module / helper / collector script block | |
| 2026-04-16T15:17:30.9105490-07:00 | PowerShell 4104 | scriptblock | powershell.exe | CI34CAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUA... | module / helper / collector script block | |
| 2026-04-16T15:17:30.9105269-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | module / manifest / collector helper block | |
| 2026-04-16T15:17:30.8030756-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | module / helper / collector script block | |
| 2026-04-16T15:17:30.4794765-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | module / helper / collector script block | |
| 2026-04-16T15:17:30.4637756-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | module / helper / collector script block | |
| 2026-04-16T15:17:30.4452832-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T15:17:30.1674696-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T15:17:30.0018536-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:30.0018523-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:30.0018481-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:30.0018468-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:30.0018455-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:30.0018441-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:30.0018399-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:30.0018385-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:30.0018371-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:30.0018357-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:30.0018341-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:30.0018289-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T15:17:29.9580690-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | module / manifest / collector helper block | |
| 2026-04-16T15:17:29.8214922-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | module / helper / collector script block | |
| 2026-04-16T15:17:29.6739836-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | collector self-activity |
| 2026-04-16T15:17:29.5543643-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | collector self-activity |
| 2026-04-16T15:16:11.7807366-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T15:16:01.0086578-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T15:16:00.4836875-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe86_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T15:16:00.3541977-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T15:15:58.8247056-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T15:15:48.0675564-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:15:48.0592522-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T15:15:09.7482519-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:15:09.7074718-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:15:07.5416799-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | service/background parent or machine account |
| 2026-04-16T15:10:48.0721530-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:10:48.0483090-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T15:10:47.8688467-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Bitdefender\Bitdefender Security\vulnerability.scan.exe | vulnerability.scan.exe <= bdservicehost.exe | --hosts-verifier --start --proxy= --proxy-authentication= | service/background parent or machine account |
| 2026-04-16T15:10:34.5183827-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T15:10:34.4768972-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T15:10:34.3645332-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T15:10:34.3302938-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | service/background parent or machine account |
| 2026-04-16T15:10:34.2369931-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | service/background parent or machine account |
| 2026-04-16T15:10:31.2777350-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T15:05:48.0418164-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:05:48.0351892-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T15:03:33.4888458-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T15:00:58.8066393-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T15:00:48.0348694-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:00:48.0290474-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T15:00:28.3262332-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T15:00:28.3185237-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | service/background parent or machine account |
| 2026-04-16T15:00:10.7934876-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:55:48.0319186-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:55:48.0232274-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:50:48.0345614-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:50:48.0235041-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:49:22.6561939-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T14:49:20.5709361-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T14:49:16.7538630-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T14:48:33.4267669-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T14:46:19.8930289-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchFilterHost.exe | SearchFilterHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchFilterHost.exe" 932 3496 3792 916 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421} | service/background parent or machine account |
| 2026-04-16T14:46:19.8201897-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchFilterHost.exe | SearchFilterHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchFilterHost.exe" 932 1848 2924 916 {4887767F-7ADC-4983-B576-88FB643D6F79} | service/background parent or machine account |
| 2026-04-16T14:46:19.1317136-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T14:46:18.3046773-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T14:46:17.8882009-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe85_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T14:45:58.8035217-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T14:45:48.0107035-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:45:48.0030626-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:45:42.1184097-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:45:39.8964158-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | service/background parent or machine account |
| 2026-04-16T14:45:05.2613384-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:44:35.1846323-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T14:44:22.6715601-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | MicrosoftEdgeUpdate.exe <= svchost.exe | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler | service/background parent or machine account |
| 2026-04-16T14:43:47.3220044-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:43:47.2829785-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T14:43:47.1540890-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T14:43:47.1207715-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | service/background parent or machine account |
| 2026-04-16T14:43:47.0290145-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | service/background parent or machine account |
| 2026-04-16T14:42:42.9349917-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:42:42.7721500-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8weky... | StoreDesktopExtension.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" ... | service/background parent or machine account |
| 2026-04-16T14:42:42.6958876-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gj... | service/background parent or machine account |
| 2026-04-16T14:42:42.6772515-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8weky... | StoreDesktopExtension.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" ... | service/background parent or machine account |
| 2026-04-16T14:42:42.6473877-07:00 | Security 4688 | process | LAB-HOST$ | C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe | Zoom.exe <= svchost.exe | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule | service/background parent or machine account |
| 2026-04-16T14:40:49.3537316-07:00 | Security 4688 | process | LAB-HOST$ | C:\ProgramData\HP\Telemetry\collectors\hp-telemetry-device-health-state-colle... | ProcInfo.exe <= hp-plugin-executor.exe | C:\ProgramData\HP\Telemetry\collectors\hp-telemetry-device-health-state-collector_ver_6.211.47160\ProcInfo.exe --hpd... | service/background parent or machine account |
| 2026-04-16T14:40:48.0002084-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:40:47.9901356-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:38:40.5181732-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | service/background parent or machine account |
| 2026-04-16T14:38:40.4596968-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:38:40.4442170-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T14:38:40.4321155-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T14:38:40.4262134-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca | service/background parent or machine account |
| 2026-04-16T14:38:40.4258691-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\BackgroundTransferHost.exe | BackgroundTransferHost.exe <= svchost.exe | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | service/background parent or machine account |
| 2026-04-16T14:38:40.4189129-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca | service/background parent or machine account |
| 2026-04-16T14:35:47.9968671-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:35:47.9883246-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:35:08.6220742-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ProcInfo.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provide... | service/background parent or machine account |
| 2026-04-16T14:33:33.3551805-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T14:33:03.9635594-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLin... | bdpatcher.exe <= bdredline.exe | "\\?\C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\redline_cl23_x64\bdpatcher.exe" | command line matches suspicious/admin patterns; service/background parent or machine account |
| 2026-04-16T14:32:44.0761292-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= sdbinst.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:32:44.0640713-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\sdbinst.exe | sdbinst.exe <= svchost.exe | C:\windows\System32\sdbinst.exe -m -bg | service/background parent or machine account |
| 2026-04-16T14:30:58.7997478-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T14:30:48.6669092-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\w32tm.exe | w32tm.exe <= cmd.exe | w32tm.exe /query /status /verbose | interactive parent: cmd.exe; service/background parent or machine account |
| 2026-04-16T14:30:48.6496341-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\cmd.exe | cmd.exe <= hp-plugin-executor.exe | C:\windows\system32\cmd.exe /c w32tm.exe /query /status /verbose | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T14:30:47.9952056-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:30:47.9870431-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:30:17.0904792-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:30:17.0794179-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | service/background parent or machine account |
| 2026-04-16T14:30:16.6711845-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:26:24.4262619-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:26:24.3833404-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T14:26:24.2541872-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T14:26:24.1194009-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | service/background parent or machine account |
| 2026-04-16T14:26:23.7561400-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\ImmersiveControlPanel\SystemSettings.exe | SystemSettings.exe <= svchost.exe | "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel | service/background parent or machine account |
| 2026-04-16T14:25:47.9812914-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:25:47.9700880-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:21:16.7195692-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T14:21:06.1923659-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T14:20:52.8658475-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T14:20:47.9765961-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:20:47.9663418-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:20:32.4110990-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T14:20:32.3776771-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | service/background parent or machine account |
| 2026-04-16T14:20:32.3186992-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T14:20:32.2861297-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal | service/background parent or machine account |
| 2026-04-16T14:20:32.2436587-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T14:20:32.2312511-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T14:20:32.1941830-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= svchost.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system | service/background parent or machine account |
| 2026-04-16T14:18:33.2810221-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T14:17:28.4926597-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | service/background parent or machine account |
| 2026-04-16T14:17:28.4728796-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Get-StartApps | user-entered script block; repeated user validation command | |
| 2026-04-16T14:17:28.2508968-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:17:28.2084599-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T14:17:28.0721194-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T14:17:27.9453035-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | service/background parent or machine account |
| 2026-04-16T14:17:27.9438613-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wermgr.exe | wermgr.exe <= svchost.exe | "C:\windows\system32\wermgr.exe" -upload | service/background parent or machine account |
| 2026-04-16T14:17:04.6265973-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPPrinterControl.AppXg27tfcrjvepe7p6m0w5zs7c77x5b4h... | service/background parent or machine account |
| 2026-04-16T14:16:01.3411230-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T14:15:58.8096294-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T14:15:56.2628268-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:15:56.2391879-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | browser helper/renderer noise |
| 2026-04-16T14:15:56.2237086-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | browser helper/renderer noise |
| 2026-04-16T14:15:56.1901348-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\smartscreen.exe | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:15:47.9645041-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:15:47.9563096-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:15:41.1968061-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T14:15:40.4579573-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe84_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T14:15:35.5729162-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T14:15:32.8547532-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T14:15:32.7840864-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T14:15:32.6438835-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T14:15:32.4850655-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | module / manifest / collector helper block | |
| 2026-04-16T14:15:32.3447094-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T14:15:32.3311343-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T14:15:32.2498090-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T14:15:32.0747594-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T14:15:31.9330205-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | module / manifest / collector helper block | |
| 2026-04-16T14:15:31.7969657-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T14:15:31.7575256-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T14:15:29.8712577-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T14:15:29.8011302-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T14:15:29.6687106-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T14:15:29.5201142-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | module / manifest / collector helper block | |
| 2026-04-16T14:15:29.3734667-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T14:15:29.3595803-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T14:15:29.2763269-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T14:15:29.1187657-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T14:15:28.9724989-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | module / manifest / collector helper block | |
| 2026-04-16T14:15:28.8319222-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T14:15:28.8172016-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T14:15:28.6274798-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T14:15:28.5283798-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T14:15:28.3550224-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T14:15:28.1984804-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | module / manifest / collector helper block | |
| 2026-04-16T14:15:28.0663153-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T14:15:28.0433417-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T14:15:22.8325933-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T14:15:22.7660499-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T14:15:22.5947047-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T14:15:22.4642073-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | module / manifest / collector helper block | |
| 2026-04-16T14:15:22.3270438-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T14:15:22.3090600-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T14:15:22.1655269-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T14:15:22.1543963-07:00 | PowerShell 4104 | scriptblock | powershell.exe | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | module / helper / collector script block | |
| 2026-04-16T14:15:22.1434393-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T14:15:22.0767550-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T14:15:21.9955488-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T14:15:21.9300192-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T14:15:21.8727409-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T14:15:21.7847681-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T14:15:21.7373426-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6891551-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6295560-07:00 | PowerShell 4104 | scriptblock | powershell.exe | undParameters.ContainsKey('OobeEnableRtpAndSigUpdate')) { [object]$__cmdletization_value = ${OobeEnableRtpAndSigUpdate} $__cmdletizatio... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6295497-07:00 | PowerShell 4104 | scriptblock | powershell.exe | on_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultV... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6295427-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableFtpParsing'; ParameterType = 'System.Man... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6295343-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ndParameters.ContainsKey('AttackSurfaceReductionOnlyExclusions')) { [object]$__cmdletization_value = ${AttackSurfaceReductionOnlyExclusions} ... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6295253-07:00 | PowerShell 4104 | scriptblock | powershell.exe | __cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletiza... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6295180-07:00 | PowerShell 4104 | scriptblock | powershell.exe | e} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableIntrusionPreventionSy... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6295100-07:00 | PowerShell 4104 | scriptblock | powershell.exe | mdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureBlobFileSharesSources'; ParameterType = 'System.Managem... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6295024-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ScheduledScanOnly} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ThrottleForScheduledScanOnly';... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6294941-07:00 | PowerShell 4104 | scriptblock | powershell.exe | __cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('ReportingA... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6294863-07:00 | PowerShell 4104 | scriptblock | powershell.exe | BoundParameters.ContainsKey('QuarantinePurgeItemsAfterDelay')) { [object]$__cmdletization_value = ${QuarantinePurgeItemsAfterDelay} $__... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6294770-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [Alias('proxbps')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ProxyBypass}, [Parameter(ParameterSetName='Remove2')]... | module / manifest / collector helper block | |
| 2026-04-16T14:15:21.6294673-07:00 | PowerShell 4104 | scriptblock | powershell.exe | arameterSetName='Remove2')] [Alias('shri')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ServiceHealthReportInterval}, ... | module / manifest / collector helper block | |
| 2026-04-16T14:15:21.6294604-07:00 | PowerShell 4104 | scriptblock | powershell.exe | } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6294532-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ystem.Int32'; Bindings = 'Error'; Value = $null; IsValuePresent = $false } $__cmdletization_methodInvocationInfo = [Microsoft.PowerShell.Cmdletization... | module / manifest / collector helper block | |
| 2026-04-16T14:15:21.6294462-07:00 | PowerShell 4104 | scriptblock | powershell.exe | dParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableQuicParsing'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $_... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6294390-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DefinitionUpdatesC... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6294313-07:00 | PowerShell 4104 | scriptblock | powershell.exe | er]@{Name = 'EnableFileHashComputation'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} ... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6294244-07:00 | PowerShell 4104 | scriptblock | powershell.exe | orce')) { [object]$__cmdletization_value = ${Force} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParame... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6294172-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $fal... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6294103-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Present} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6294017-07:00 | PowerShell 4104 | scriptblock | powershell.exe | on_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('SharedSignaturesPath')) { [object]$__cmdletization_value = ${Shared... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6293939-07:00 | PowerShell 4104 | scriptblock | powershell.exe | etization_value = ${ScanAvgCPULoadFactor} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ScanAvg... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6293822-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ation_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionAggressiveness')) { [object]$__cmdleti... | module / helper / collector script block | |
| 2026-04-16T14:15:21.6293652-07:00 | PowerShell 4104 | scriptblock | powershell.exe | eReductionRules_RuleSpecificExclusions}, [Parameter(ParameterSetName='Set0')] [Alias('oobers')] [ValidateNotNull()] [ValidateNotNullOrE... | module / manifest / collector helper block | |
| 2026-04-16T14:15:21.6293564-07:00 | PowerShell 4104 | scriptblock | powershell.exe | sableIntrusionPreventionSystem}, [Parameter(ParameterSetName='Set0')] [Alias('dioavp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] ... | module / manifest / collector helper block | |
| 2026-04-16T14:15:21.6293476-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T14:15:21.4243127-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T14:15:21.3333176-07:00 | PowerShell 4104 | scriptblock | powershell.exe | UHAQEEUjBQME4GCCsGAQUFBzAChkJodHRwOi8vd3d3Lm1p # Y3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y # Mi5jcnQwgZ8GA1UdIASBlzCBlDCBkQYJKwYBBAG... | module / helper / collector script block | |
| 2026-04-16T14:15:21.3333102-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | module / manifest / collector helper block | |
| 2026-04-16T14:15:21.2037649-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | module / helper / collector script block | |
| 2026-04-16T14:15:20.8944048-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | module / helper / collector script block | |
| 2026-04-16T14:15:20.8799894-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | module / helper / collector script block | |
| 2026-04-16T14:15:20.8624773-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T14:15:20.5843389-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T14:15:20.4154483-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.4154470-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.4154458-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.4154445-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.4154389-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.4154376-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.4154364-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.4154350-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.4154310-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.4154297-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.4154283-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.4154263-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T14:15:20.3706267-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | module / manifest / collector helper block | |
| 2026-04-16T14:15:20.2110078-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | module / helper / collector script block | |
| 2026-04-16T14:15:20.0730851-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | collector self-activity |
| 2026-04-16T14:15:19.9598634-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | collector self-activity |
| 2026-04-16T14:15:10.9996131-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:13:27.5786854-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T14:13:23.9584368-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\sppsvc.exe | sppsvc.exe <= services.exe | C:\windows\system32\sppsvc.exe | service/background parent or machine account |
| 2026-04-16T14:13:03.6091331-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\ImmersiveControlPanel\SystemSettings.exe | SystemSettings.exe <= svchost.exe | "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel | service/background parent or machine account |
| 2026-04-16T14:11:07.2395652-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T14:11:05.4320442-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:10:58.2676910-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:10:54.6248170-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T14:10:53.7401824-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe83_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T14:10:53.1114518-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:10:48.9365149-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\oobe\UserOOBEBroker.exe | UserOOBEBroker.exe <= svchost.exe | C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:10:47.9492085-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:10:47.9433300-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:10:47.8602401-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Bitdefender\Bitdefender Security\vulnerability.scan.exe | vulnerability.scan.exe <= bdservicehost.exe | --hosts-verifier --start --proxy= --proxy-authentication= | service/background parent or machine account |
| 2026-04-16T14:10:18.8155182-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T14:10:18.0189405-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Bitdefender\Bitdefender Security\bdfvwiz.exe | bdfvwiz.exe <= bdservicehost.exe | "C:\Program Files\Bitdefender\Bitdefender Security\bdfvwiz.exe" --type=model --path=C:\Users\labuser\AppData\Local\Temp\bdfC... | service/background parent or machine account |
| 2026-04-16T14:09:49.1281722-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Bitdefender\Bitdefender Security App\bdfvwiz.exe | bdfvwiz.exe <= bdservicehost.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\bdfvwiz.exe" --type=view --path=C:\Users\labuser\AppData\Local\Temp\b... | service/background parent or machine account |
| 2026-04-16T14:09:49.0427802-07:00 | Security 4688 | process | labuser | C:\Program Files\Bitdefender\Bitdefender Security App\bdfvwiz.exe | bdfvwiz.exe <= seccenter.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\bdfvwiz.exe" --type=view --path=C:\Users\labuser\AppData\Local\Temp\bdf57... | interactive user account |
| 2026-04-16T14:09:35.4488625-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Bitdefender\Bitdefender Security App\seccenter.exe | seccenter.exe <= bdservicehost.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\seccenter.exe" source:systray | service/background parent or machine account |
| 2026-04-16T14:09:35.3323135-07:00 | Security 4688 | process | labuser | C:\Program Files\Bitdefender\Bitdefender Security App\seccenter.exe | seccenter.exe <= bdagent.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\seccenter.exe" source:systray | interactive user account |
| 2026-04-16T14:08:43.0383537-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T14:08:35.0121960-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{9F156763-7844-4DC4-B2B1-901F640F5155} | service/background parent or machine account |
| 2026-04-16T14:08:25.6211141-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T14:08:25.0871920-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T14:07:56.1698502-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:07:50.5650166-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:07:41.3773656-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:07:30.4988131-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:07:07.2501367-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:07:02.1597528-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:07:00.3017658-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.... | TiWorker.exe <= svchost.exe | C:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8247_none_a53a4f5b773e04f9\TiWorker.exe -E... | service/background parent or machine account |
| 2026-04-16T14:07:00.2643962-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\servicing\TrustedInstaller.exe | TrustedInstaller.exe <= services.exe | C:\windows\servicing\TrustedInstaller.exe | service/background parent or machine account |
| 2026-04-16T14:06:59.2331408-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\sppsvc.exe | sppsvc.exe <= services.exe | C:\windows\system32\sppsvc.exe | service/background parent or machine account |
| 2026-04-16T14:06:57.3944613-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:06:51.0037242-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:06:43.6279307-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:06:37.9946059-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T14:06:37.9698150-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:06:37.9108417-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T14:06:37.8874613-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca | service/background parent or machine account |
| 2026-04-16T14:06:35.1712214-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:06:35.1196229-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T14:06:35.0004623-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T14:06:34.9836825-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\taskhostw.exe | taskhostw.exe <= svchost.exe | taskhostw.exe | service/background parent or machine account |
| 2026-04-16T14:06:34.6673261-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\Taskmgr.exe | Taskmgr.exe <= Taskmgr.exe | "C:\windows\system32\Taskmgr.exe" | service/background parent or machine account |
| 2026-04-16T14:06:34.5985579-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\consent.exe | consent.exe <= svchost.exe | consent.exe 4976 448 0000025EA21CB7D0 | service/background parent or machine account |
| 2026-04-16T14:06:34.5447508-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:06:29.4238828-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:06:01.2537508-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T14:06:00.8621657-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wek... | OpenConsole.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wekyb3d8bbwe\OpenConsole.exe" -Embedding | service/background parent or machine account |
| 2026-04-16T14:06:00.8424219-07:00 | Security 4688 | process | labuser | C:\Windows\System32\conhost.exe | conhost.exe <= powershell.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | console host child of interactive shell |
| 2026-04-16T14:06:00.8423390-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:05:56.2499839-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T14:05:55.3334431-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe82_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T14:05:54.8940068-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:05:47.9735993-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:05:47.9380069-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:05:47.6717279-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wek... | OpenConsole.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wekyb3d8bbwe\OpenConsole.exe" -Embedding | service/background parent or machine account |
| 2026-04-16T14:05:47.6520635-07:00 | Security 4688 | process | labuser | C:\Windows\System32\conhost.exe | conhost.exe <= cmd.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | console host child of interactive shell |
| 2026-04-16T14:05:47.6520100-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:05:27.7227063-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:05:21.8070367-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $Host | module / manifest / collector helper block | |
| 2026-04-16T14:05:21.7721114-07:00 | PowerShell 4104 | scriptblock | powershell.exe | prompt | module / helper / collector script block | |
| 2026-04-16T14:05:21.5774297-07:00 | Security 4688 | process | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wek... | OpenConsole.exe <= WindowsTerminal.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless ... | interactive user account |
| 2026-04-16T14:05:21.3071202-07:00 | Security 4688 | process | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wek... | WindowsTerminal.exe <= wt.exe | wt.exe -p {61c54bbd-c2c6-5271-96e7-009a87ff44bf} | interactive user account |
| 2026-04-16T14:05:21.0527736-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\SysWOW64\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | service/background parent or machine account |
| 2026-04-16T14:05:20.9973437-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | service/background parent or machine account |
| 2026-04-16T14:05:20.9334543-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | service/background parent or machine account |
| 2026-04-16T14:05:04.8024165-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:05:04.7223934-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:05:03.5840465-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:05:03.4911340-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:04:28.5757623-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:04:28.5311047-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T14:04:23.7743545-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T14:04:16.6475567-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:04:13.0761752-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:04:12.9775686-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:04:12.9770118-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:03:33.5430322-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:03:33.5018811-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T14:03:33.4225117-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:03:33.3490078-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca | service/background parent or machine account |
| 2026-04-16T14:03:32.9744240-07:00 | Security 4688 | process | labuser | C:\Windows\System32\conhost.exe | conhost.exe <= dumpcap.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | interactive user account |
| 2026-04-16T14:03:32.9667844-07:00 | Security 4688 | process | labuser | C:\Program Files\Wireshark\dumpcap.exe | dumpcap.exe <= Wireshark.exe | "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -F pcapng -i \Device\NPF_{9F21DB48... | interactive user account |
| 2026-04-16T14:03:29.8522222-07:00 | Security 4688 | process | labuser | C:\Windows\System32\conhost.exe | conhost.exe <= etwdump.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | interactive user account |
| 2026-04-16T14:03:29.8472683-07:00 | Security 4688 | process | labuser | C:\Program Files\Wireshark\extcap\etwdump.exe | etwdump.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-dlts --extcap-interface etwdump | interactive user account |
| 2026-04-16T14:03:29.8267943-07:00 | Security 4688 | process | labuser | C:\Program Files\Wireshark\extcap\USBPcapCMD.exe | USBPcapCMD.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --extcap-dlts --extcap-interface \\.\USBPcap1 | interactive user account; command line matches suspicious/admin patterns |
| 2026-04-16T14:03:29.7593608-07:00 | Security 4688 | process | labuser | C:\Windows\System32\conhost.exe | conhost.exe <= dumpcap.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | interactive user account |
| 2026-04-16T14:03:29.7520474-07:00 | Security 4688 | process | labuser | C:\Program Files\Wireshark\dumpcap.exe | dumpcap.exe <= Wireshark.exe | "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S -D -L --signal-pipe 16068.dummy... | interactive user account |
| 2026-04-16T14:03:29.5964673-07:00 | Security 4688 | process | labuser | C:\Windows\System32\conhost.exe | conhost.exe <= etwdump.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | interactive user account |
| 2026-04-16T14:03:29.5907436-07:00 | Security 4688 | process | labuser | C:\Program Files\Wireshark\extcap\etwdump.exe | etwdump.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump | interactive user account |
| 2026-04-16T14:03:29.5525802-07:00 | Security 4688 | process | labuser | C:\Program Files\Wireshark\extcap\USBPcapCMD.exe | USBPcapCMD.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --extcap-config --extcap-interface \\.\USBPcap1 | interactive user account; command line matches suspicious/admin patterns |
| 2026-04-16T14:03:29.5355263-07:00 | Security 4688 | process | labuser | C:\Windows\System32\conhost.exe | conhost.exe <= etwdump.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | interactive user account |
| 2026-04-16T14:03:29.5265032-07:00 | Security 4688 | process | labuser | C:\Program Files\Wireshark\extcap\etwdump.exe | etwdump.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-interfaces --extcap-version=4.6 | interactive user account |
| 2026-04-16T14:03:29.5261261-07:00 | Security 4688 | process | labuser | C:\Program Files\Wireshark\extcap\USBPcapCMD.exe | USBPcapCMD.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --extcap-interfaces --extcap-version=4.6 | interactive user account |
| 2026-04-16T14:03:18.6040579-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wermgr.exe | wermgr.exe <= svchost.exe | "C:\windows\system32\wermgr.exe" -upload | service/background parent or machine account |
| 2026-04-16T14:03:17.7579220-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\WerFault.exe | WerFault.exe <= svchost.exe | werfault.exe /h /shared Global\cced5e5a20634c278be26e1e3fc7e557 /t 21776 /p 31004 | service/background parent or machine account |
| 2026-04-16T14:03:17.7167167-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k WerSvcGroup | service/background parent or machine account |
| 2026-04-16T14:03:08.4569371-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\Taskmgr.exe | Taskmgr.exe <= Taskmgr.exe | "C:\windows\system32\taskmgr.exe" /4 | service/background parent or machine account |
| 2026-04-16T14:03:08.3800422-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\consent.exe | consent.exe <= svchost.exe | consent.exe 4976 452 0000025EA3633BF0 | service/background parent or machine account |
| 2026-04-16T14:02:12.8447930-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k netsvcs -p -s wuauserv | service/background parent or machine account |
| 2026-04-16T14:02:12.7727092-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:02:12.7248881-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T14:02:12.5729601-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T14:02:12.5354483-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T14:02:12.4721155-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca | service/background parent or machine account |
| 2026-04-16T14:02:12.4106743-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | service/background parent or machine account |
| 2026-04-16T14:02:12.3937041-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\taskhostw.exe | taskhostw.exe <= svchost.exe | taskhostw.exe | service/background parent or machine account |
| 2026-04-16T14:01:54.6784297-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T14:01:48.7745261-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T14:01:21.4270496-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DataExchangeHost.exe | DataExchangeHost.exe <= svchost.exe | C:\Windows\System32\DataExchangeHost.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:01:20.0499672-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" | interactive parent: explorer.exe; service/background parent or machine account |
| 2026-04-16T14:01:13.0361015-07:00 | Security 4688 | process | labuser | C:\Windows\System32\conhost.exe | conhost.exe <= cmd.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | console host child of interactive shell |
| 2026-04-16T14:01:11.9189425-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:01:11.7881697-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelServi... | browser helper/renderer noise |
| 2026-04-16T14:01:11.7859667-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --origin-trial-disabled-features=Canva... | browser helper/renderer noise |
| 2026-04-16T14:01:11.7409066-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:01:11.7401887-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:01:11.7181703-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --top-chrome-webui --origin-trial-disabled-features=Canvas... | browser helper/renderer noise |
| 2026-04-16T14:01:10.1504621-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:01:10.1295223-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | browser helper/renderer noise |
| 2026-04-16T14:00:58.7772866-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T14:00:57.6986386-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:00:57.6985266-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T14:00:57.6737004-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | browser helper/renderer noise |
| 2026-04-16T14:00:57.6214703-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\smartscreen.exe | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:00:52.6284683-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T14:00:49.0065302-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T14:00:48.9593625-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T14:00:47.9334515-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T14:00:47.9271376-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T14:00:16.4403728-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe81_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T14:00:14.7367305-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T14:00:05.3080854-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:59:28.5111604-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wermgr.exe | wermgr.exe <= svchost.exe | "C:\windows\system32\wermgr.exe" -upload | service/background parent or machine account |
| 2026-04-16T13:59:10.4753483-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T13:56:54.7463553-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\rundll32.exe | rundll32.exe <= msiexec.exe | rundll32.exe "C:\windows\Installer\MSI86BE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_101877437 7 HPOneAgentCustomAction... | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T13:56:54.6740970-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\rundll32.exe | rundll32.exe <= msiexec.exe | rundll32.exe "C:\windows\Installer\MSI8650.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_101877359 2 HPOneAgentCustomAction... | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T13:56:54.6474513-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\msiexec.exe | msiexec.exe <= msiexec.exe | C:\Windows\System32\MsiExec.exe -Embedding 3F2490A49F9D96B19F0A79AFB2D1C23B E Global\MSI0000 | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T13:56:53.8453667-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost | service/background parent or machine account |
| 2026-04-16T13:56:52.8115404-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\msiexec.exe | msiexec.exe <= services.exe | C:\windows\system32\msiexec.exe /V | script host / LOLBin / admin tool; service/background parent or machine account |
| 2026-04-16T13:56:52.4775688-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\Temp\{215F1C21-273A-45A5-9082-9DEA74C518A9}\.cr\vc_redist.x64.exe | vc_redist.x64.exe <= vc_redist.x64.exe | "C:\windows\Temp\{215F1C21-273A-45A5-9082-9DEA74C518A9}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Pack... | service/background parent or machine account |
| 2026-04-16T13:56:52.2737414-07:00 | Security 4688 | process | LAB-HOST$ | C:\ProgramData\Package Cache\20E2D7437367CB262CE45184EB4D809249FE654AA450D226... | vc_redist.x64.exe <= HPOneAgent.exe | "C:\ProgramData\Package Cache\20E2D7437367CB262CE45184EB4D809249FE654AA450D226E376D4057C00B58E\vc_redist.x64.exe" -burn... | service/background parent or machine account |
| 2026-04-16T13:56:50.7931555-07:00 | Security 4688 | process | LAB-HOST$ | C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgen... | HPOneAgent.exe <= HPOneAgent.exe | "C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe" -q -burn.elevated BurnPipe.{C5CE82A4-... | service/background parent or machine account |
| 2026-04-16T13:56:50.7141751-07:00 | Security 4688 | process | LAB-HOST$ | C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgen... | HPOneAgent.exe <= HPOneAgent.exe | "C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe" -burn.clean.room="C:\ProgramData\Pack... | service/background parent or machine account |
| 2026-04-16T13:56:50.6830377-07:00 | Security 4688 | process | LAB-HOST$ | C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgen... | HPOneAgent.exe <= svchost.exe | "C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe" /s /v /qn /min /repair /norestart FiredF... | service/background parent or machine account |
| 2026-04-16T13:55:47.9314409-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:55:47.9255724-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:55:23.0780912-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T13:55:14.3287540-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T13:55:02.3132619-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T13:51:07.9388774-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T13:51:02.8375717-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T13:51:02.8122368-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | browser helper/renderer noise |
| 2026-04-16T13:51:02.7986015-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | browser helper/renderer noise |
| 2026-04-16T13:51:02.7661912-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\smartscreen.exe | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:50:48.4220289-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T13:50:47.9250386-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:50:47.9150464-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:50:38.8684360-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:50:36.1442851-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T13:50:36.0757222-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:50:35.8995533-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T13:50:35.7379971-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | module / manifest / collector helper block | |
| 2026-04-16T13:50:35.5930781-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:50:35.5785746-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:50:35.4984781-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:50:35.3200665-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T13:50:35.1619607-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | module / manifest / collector helper block | |
| 2026-04-16T13:50:35.0198668-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:50:34.9810527-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:50:33.1848663-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T13:50:33.1119742-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:50:32.9573731-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T13:50:32.8535215-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | module / manifest / collector helper block | |
| 2026-04-16T13:50:32.7005303-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:50:32.6851945-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:50:32.6044997-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:50:32.4376782-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T13:50:32.2831349-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | module / manifest / collector helper block | |
| 2026-04-16T13:50:32.1391488-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:50:32.1228995-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:50:31.9311030-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T13:50:31.8286901-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:50:31.6603409-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T13:50:31.5141498-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | module / manifest / collector helper block | |
| 2026-04-16T13:50:31.3737272-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:50:31.3492681-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:50:26.2928694-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T13:50:26.2248316-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:50:26.0685576-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T13:50:25.9039748-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | module / manifest / collector helper block | |
| 2026-04-16T13:50:25.7656475-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:50:25.7456886-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:50:25.6111408-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T13:50:25.6000979-07:00 | PowerShell 4104 | scriptblock | powershell.exe | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.5887233-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.4976224-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.4397449-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.3732573-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.3057687-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.2254560-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.1609299-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.1134802-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478842-07:00 | PowerShell 4104 | scriptblock | powershell.exe | dPoolCap} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'RemoveScanningThreadPoolCap'; Parameter... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478792-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ystem.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdlet... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478721-07:00 | PowerShell 4104 | scriptblock | powershell.exe | sent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AllowDatagramProc... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478664-07:00 | PowerShell 4104 | scriptblock | powershell.exe | else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableTlsParsing'; ParameterType = 'Syste... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478601-07:00 | PowerShell 4104 | scriptblock | powershell.exe | } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ControlledFolderAccessAllowedApplication... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478520-07:00 | PowerShell 4104 | scriptblock | powershell.exe | meter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'LowThreatDefaultAction'; ParameterType = 'System.Management.Automation.SwitchParameter'... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478453-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Value; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478389-07:00 | PowerShell 4104 | scriptblock | powershell.exe | dParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPr... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478320-07:00 | PowerShell 4104 | scriptblock | powershell.exe | on_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('SignatureUpdateInterval')) { [object]$__cmdletization_value = ${Sig... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478258-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ystem.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdlet... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478193-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'Reporting... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478125-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('R... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0478056-07:00 | PowerShell 4104 | scriptblock | powershell.exe | cmdletization_objectModelWrapper -is [System.Management.Automation.IDynamicParameters]) { ([System.Management.Automatio... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0477991-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [ValidateNotNullOrEmpty()] [switch] ${LowThreatDefaultAction}, [Parameter(ParameterSetName='Remove2')] [Alias('mtdefac')] [Validat... | module / manifest / collector helper block | |
| 2026-04-16T13:50:25.0477921-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ] [ValidateNotNullOrEmpty()] [string[]] ${BruteForceProtectionExclusions}, [Parameter(ParameterSetName='Remove2')] [Alias('bfplnb'... | module / manifest / collector helper block | |
| 2026-04-16T13:50:25.0477866-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ue = ${AttackSurfaceReductionRules_Ids} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSur... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0477800-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [string[]] ${BruteForceProtectionExclusions}, [Parameter(ParameterSetName='Add1')] [switch] ${Force}, [Parameter(ParameterSetNam... | module / manifest / collector helper block | |
| 2026-04-16T13:50:25.0477729-07:00 | PowerShell 4104 | scriptblock | powershell.exe | hodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIs... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0477673-07:00 | PowerShell 4104 | scriptblock | powershell.exe | an'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.Powe... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0477606-07:00 | PowerShell 4104 | scriptblock | powershell.exe | '; ParameterType = 'Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.UpdatesChannelType'; Bindings = 'In'; Value = $__cmdletization_value; IsVa... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0477515-07:00 | PowerShell 4104 | scriptblock | powershell.exe | n'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletizati... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0477447-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ypes.MpPreference.PUAProtectionType'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0477367-07:00 | PowerShell 4104 | scriptblock | powershell.exe | aultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('UILockdown')) { [o... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0477297-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'Disab... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0477230-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ng')) { [object]$__cmdletization_value = ${DisableDatagramProcessing} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletiz... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0477153-07:00 | PowerShell 4104 | scriptblock | powershell.exe | = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__c... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0477049-07:00 | PowerShell 4104 | scriptblock | powershell.exe | e} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'CheckForSignaturesBeforeRunn... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0476962-07:00 | PowerShell 4104 | scriptblock | powershell.exe | erType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParame... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0476714-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ers.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = ... | module / helper / collector script block | |
| 2026-04-16T13:50:25.0476631-07:00 | PowerShell 4104 | scriptblock | powershell.exe | meter(ParameterSetName='Set0')] [Alias('ddnstcpp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${DisableDnsOverTcpParsing... | module / manifest / collector helper block | |
| 2026-04-16T13:50:25.0476570-07:00 | PowerShell 4104 | scriptblock | powershell.exe | [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${MeteredConnectionUpdates}, [Parameter(ParameterSetName='Set0')] [Alias('an... | module / manifest / collector helper block | |
| 2026-04-16T13:50:25.0476490-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T13:50:24.8358549-07:00 | PowerShell 4104 | scriptblock | powershell.exe | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | module / helper / collector script block | |
| 2026-04-16T13:50:24.7290045-07:00 | PowerShell 4104 | scriptblock | powershell.exe | PgcuKZvmPRul1LUd # d5Q54ulkyUQ9eHoj8xN9ppB0g430yyYCRirCihC7pKkFDJvtaPpoLpWgKj8qa1hJ # Yx8JaW5amJbkg/TAj/NGK978O9C9Ne9uJa7lryft0N3zDq+ZKJeYTQ49C/IIidYf # w... | module / helper / collector script block | |
| 2026-04-16T13:50:24.7289971-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | module / manifest / collector helper block | |
| 2026-04-16T13:50:24.5870257-07:00 | PowerShell 4104 | scriptblock | powershell.exe | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | module / helper / collector script block | |
| 2026-04-16T13:50:24.2776569-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | module / helper / collector script block | |
| 2026-04-16T13:50:24.2627744-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | module / helper / collector script block | |
| 2026-04-16T13:50:24.2443435-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:50:23.9817630-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T13:50:23.8071523-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.8071509-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.8071474-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.8071462-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.8071449-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.8071436-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.8071382-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.8071369-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.8071356-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.8071342-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.8071327-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.8071254-07:00 | PowerShell 4104 | scriptblock | powershell.exe | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | module / helper / collector script block | |
| 2026-04-16T13:50:23.7686771-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | module / manifest / collector helper block | |
| 2026-04-16T13:50:23.6191877-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | module / helper / collector script block | |
| 2026-04-16T13:50:23.4757305-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | collector self-activity |
| 2026-04-16T13:50:23.3661081-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | collector self-activity |
| 2026-04-16T13:50:11.3589401-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\SysWOW64\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | service/background parent or machine account |
| 2026-04-16T13:50:11.2763605-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | service/background parent or machine account |
| 2026-04-16T13:50:11.1136235-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | service/background parent or machine account |
| 2026-04-16T13:50:07.7061450-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T13:50:01.6066274-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe80_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T13:50:01.3449795-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T13:50:01.1641794-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T13:48:33.2100507-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T13:47:16.7335389-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\taskhostw.exe | taskhostw.exe <= svchost.exe | taskhostw.exe | service/background parent or machine account |
| 2026-04-16T13:46:43.4551065-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe79_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T13:46:32.8909287-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\SysWOW64\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | service/background parent or machine account |
| 2026-04-16T13:46:32.8007710-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | service/background parent or machine account |
| 2026-04-16T13:46:32.6448829-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | service/background parent or machine account |
| 2026-04-16T13:45:58.8133881-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:45:58.7735279-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T13:45:58.7569754-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXpybpk6fj2fe0gb0jan49e6dncngk3pa1.mca | service/background parent or machine account |
| 2026-04-16T13:45:47.9187726-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:45:47.9091211-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:45:34.0441506-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:45:34.0315833-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | service/background parent or machine account |
| 2026-04-16T13:45:16.3344057-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:44:22.6688947-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | MicrosoftEdgeUpdate.exe <= svchost.exe | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler | service/background parent or machine account |
| 2026-04-16T13:42:42.9427323-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:42:42.6875655-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gj... | service/background parent or machine account |
| 2026-04-16T13:42:42.6476418-07:00 | Security 4688 | process | LAB-HOST$ | C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe | Zoom.exe <= svchost.exe | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule | service/background parent or machine account |
| 2026-04-16T13:42:17.1333117-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wermgr.exe | wermgr.exe <= svchost.exe | "C:\windows\system32\wermgr.exe" -upload | service/background parent or machine account |
| 2026-04-16T13:42:16.1406046-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\WerFault.exe | WerFault.exe <= svchost.exe | werfault.exe /h /shared Global\972100956a524594ae66c0be221e5e83 /t 17236 /p 17832 | service/background parent or machine account |
| 2026-04-16T13:42:16.1033422-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k WerSvcGroup | service/background parent or machine account |
| 2026-04-16T13:42:01.4436111-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\Taskmgr.exe | Taskmgr.exe <= Taskmgr.exe | "C:\windows\system32\taskmgr.exe" /4 | service/background parent or machine account |
| 2026-04-16T13:42:01.3678721-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\consent.exe | consent.exe <= svchost.exe | consent.exe 4976 452 0000025EA21CBDE0 | service/background parent or machine account |
| 2026-04-16T13:41:18.6110882-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:40:53.9832277-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DataExchangeHost.exe | DataExchangeHost.exe <= svchost.exe | C:\Windows\System32\DataExchangeHost.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:40:47.9147427-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:40:47.9044452-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:40:43.3487634-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8weky... | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\Des... | interactive parent: explorer.exe; service/background parent or machine account |
| 2026-04-16T13:40:04.2964938-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T13:39:55.3070050-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T13:39:43.9828559-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | browser helper/renderer noise |
| 2026-04-16T13:37:58.6328644-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T13:37:58.6252050-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca | service/background parent or machine account |
| 2026-04-16T13:36:49.2152514-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T13:36:44.1216156-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T13:36:44.0917495-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | browser helper/renderer noise |
| 2026-04-16T13:36:44.0751671-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | browser helper/renderer noise |
| 2026-04-16T13:36:44.0427578-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\smartscreen.exe | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:36:15.8173320-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:36:15.7741032-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:36:13.5966025-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | service/background parent or machine account |
| 2026-04-16T13:35:47.9099711-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:35:47.9009099-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:35:07.7673512-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ProcInfo.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provide... | service/background parent or machine account |
| 2026-04-16T13:34:47.3607030-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:34:47.3222025-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T13:34:47.1986874-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T13:34:47.1729461-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | service/background parent or machine account |
| 2026-04-16T13:34:47.0800444-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | service/background parent or machine account |
| 2026-04-16T13:33:33.1496139-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T13:32:47.4899302-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\BackgroundTransferHost.exe | BackgroundTransferHost.exe <= svchost.exe | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | service/background parent or machine account |
| 2026-04-16T13:32:47.4272842-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | service/background parent or machine account |
| 2026-04-16T13:32:47.4082533-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:32:47.3356162-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca | service/background parent or machine account |
| 2026-04-16T13:32:43.9653902-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= sdbinst.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:32:43.9552471-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\sdbinst.exe | sdbinst.exe <= svchost.exe | C:\windows\System32\sdbinst.exe -m -bg | service/background parent or machine account |
| 2026-04-16T13:31:12.1322580-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T13:31:02.4723267-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:30:59.7498198-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T13:30:59.6820759-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:30:59.5158868-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T13:30:59.3818240-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | module / manifest / collector helper block | |
| 2026-04-16T13:30:59.2363494-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:30:59.2212041-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:30:59.1366571-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:30:59.0125988-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T13:30:58.8833524-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | module / manifest / collector helper block | |
| 2026-04-16T13:30:58.7659154-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T13:30:58.7454818-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:30:58.7050441-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:30:56.9430555-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T13:30:56.8726875-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:30:56.7152876-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T13:30:56.5569002-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | module / manifest / collector helper block | |
| 2026-04-16T13:30:56.4178661-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:30:56.4029496-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:30:56.3218175-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:30:56.1671287-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | module / manifest / collector helper block | |
| 2026-04-16T13:30:56.0524200-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | module / manifest / collector helper block | |
| 2026-04-16T13:30:55.9143317-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:30:55.8989436-07:00 | PowerShell 4104 | scriptblock | powershell.exe | $global:? | module / manifest / collector helper block | |
| 2026-04-16T13:30:55.6921700-07:00 | PowerShell 4104 | scriptblock | powershell.exe | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | module / manifest / collector helper block | |
| 2026-04-16T13:30:55.5891263-07:00 | PowerShell 4104 | scriptblock | powershell.exe | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | module / manifest / collector helper block | |
| 2026-04-16T13:30:55.1175411-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:30:49.2662285-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:30:49.0584813-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T13:30:47.9156450-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:30:47.8951141-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:30:46.8677872-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | collector self-activity |
| 2026-04-16T13:30:46.7608104-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | collector self-activity |
| 2026-04-16T13:30:32.9088808-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\SysWOW64\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | service/background parent or machine account |
| 2026-04-16T13:30:32.8270843-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | service/background parent or machine account |
| 2026-04-16T13:30:32.6886268-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | service/background parent or machine account |
| 2026-04-16T13:30:30.4214907-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T13:30:22.0508285-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T13:30:20.4697470-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T13:30:17.5517608-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\SysWOW64\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | service/background parent or machine account |
| 2026-04-16T13:30:17.4577490-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | service/background parent or machine account |
| 2026-04-16T13:30:17.3058971-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | service/background parent or machine account |
| 2026-04-16T13:30:10.7452115-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:28:34.5396935-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T13:27:43.2047263-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:27:42.6943818-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:27:40.3967661-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:27:39.8326411-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:27:39.0528214-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:27:33.4902635-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | collector self-activity |
| 2026-04-16T13:27:33.3377460-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | service/background parent or machine account |
| 2026-04-16T13:27:31.1898209-07:00 | Security 4688 | process | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | collector self-activity |
| 2026-04-16T13:27:31.0744323-07:00 | Security 4688 | process | labuser | C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | collector self-activity |
| 2026-04-16T13:27:19.2849429-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\SysWOW64\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | service/background parent or machine account |
| 2026-04-16T13:27:19.1963565-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | service/background parent or machine account |
| 2026-04-16T13:27:19.0449489-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | service/background parent or machine account |
| 2026-04-16T13:27:11.6835019-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | browser helper/renderer noise |
| 2026-04-16T13:27:10.0891788-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\dllhost.exe | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T13:27:09.5308958-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe78_ Global\UsGthrCtrlFltPipeMssGthr... | service/background parent or machine account |
| 2026-04-16T13:26:20.5591962-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T13:25:47.8920160-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:25:47.8854682-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:23:47.1625078-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:23:47.1221466-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:23:44.9429369-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | service/background parent or machine account |
| 2026-04-16T13:21:35.7541717-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe | SDXHelper.exe <= svchost.exe | "C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding | service/background parent or machine account |
| 2026-04-16T13:21:35.6712023-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe | SDXHelper.exe <= svchost.exe | "C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe" | service/background parent or machine account |
| 2026-04-16T13:20:47.8989941-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:20:47.8886908-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:20:32.4056654-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T13:20:32.3754382-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | service/background parent or machine account |
| 2026-04-16T13:20:32.3179419-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T13:20:32.2852167-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal | service/background parent or machine account |
| 2026-04-16T13:20:32.2309478-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | service/background parent or machine account |
| 2026-04-16T13:20:32.2251469-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T13:20:32.1899684-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe | updater.exe <= svchost.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system | service/background parent or machine account |
| 2026-04-16T13:18:33.0780517-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T13:15:58.7473865-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T13:15:47.8758029-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:15:47.8692231-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:15:41.8868544-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:15:41.8449268-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T13:15:41.7275640-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T13:15:41.6949665-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | service/background parent or machine account |
| 2026-04-16T13:15:41.6025228-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | service/background parent or machine account |
| 2026-04-16T13:15:22.6334456-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:15:22.6211866-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b... | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | service/background parent or machine account |
| 2026-04-16T13:15:05.1969308-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:14:22.6746244-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | MicrosoftEdgeUpdate.exe <= svchost.exe | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c | service/background parent or machine account |
| 2026-04-16T13:11:10.5939050-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T13:10:52.9334518-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:10:52.8905483-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | service/background parent or machine account |
| 2026-04-16T13:10:52.7635377-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | service/background parent or machine account |
| 2026-04-16T13:10:52.6328681-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | service/background parent or machine account |
| 2026-04-16T13:10:50.1444572-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.... | TiWorker.exe <= svchost.exe | C:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8247_none_a53a4f5b773e04f9\TiWorker.exe -E... | service/background parent or machine account |
| 2026-04-16T13:10:50.1171564-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\servicing\TrustedInstaller.exe | TrustedInstaller.exe <= services.exe | C:\windows\servicing\TrustedInstaller.exe | service/background parent or machine account |
| 2026-04-16T13:10:50.1069914-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\smartscreen.exe | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | service/background parent or machine account |
| 2026-04-16T13:10:50.0768573-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k netsvcs -p -s PushToInstall | service/background parent or machine account |
| 2026-04-16T13:10:50.0668360-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k netsvcs -s LxpSvc | service/background parent or machine account |
| 2026-04-16T13:10:50.0495873-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= sc.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:10:50.0366998-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\taskhostw.exe | taskhostw.exe <= svchost.exe | taskhostw.exe | service/background parent or machine account |
| 2026-04-16T13:10:50.0364592-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\sc.exe | sc.exe <= svchost.exe | "C:\windows\system32\sc.exe" start pushtoinstall login | service/background parent or machine account |
| 2026-04-16T13:10:47.8827296-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:10:47.8688016-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:10:47.8501312-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\Bitdefender\Bitdefender Security\vulnerability.scan.exe | vulnerability.scan.exe <= bdservicehost.exe | --hosts-verifier --start --proxy= --proxy-authentication= | service/background parent or machine account |
| 2026-04-16T13:07:37.3775891-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T13:07:25.9209000-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\CredentialUIBroker.exe | CredentialUIBroker.exe <= svchost.exe | "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding | service/background parent or machine account |
| 2026-04-16T13:07:20.7358037-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T13:07:00.8940676-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T13:07:00.3656997-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T13:06:55.3577143-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T13:06:55.2593090-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T13:06:06.9307072-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | service/background parent or machine account |
| 2026-04-16T13:05:47.8656213-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:05:47.8550280-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:03:33.0008661-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | service/background parent or machine account |
| 2026-04-16T13:03:13.3097678-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | browser helper/renderer noise |
| 2026-04-16T13:00:58.7385464-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | service/background parent or machine account |
| 2026-04-16T13:00:47.8531515-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\conhost.exe | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | service/background parent or machine account |
| 2026-04-16T13:00:47.8472929-07:00 | Security 4688 | process | LAB-HOST$ | C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | service/background parent or machine account |
| 2026-04-16T13:00:16.7027092-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\wbem\WmiPrvSE.exe | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | service/background parent or machine account |
| 2026-04-16T12:59:49.0003157-07:00 | Security 4688 | process | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | browser helper/renderer noise |
| 2026-04-16T12:58:04.6331649-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\svchost.exe | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k McpManagementServiceGroup | service/background parent or machine account |
| 2026-04-16T12:58:03.2210884-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\RuntimeBroker.exe | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | service/background parent or machine account |
| 2026-04-16T12:58:03.1321273-07:00 | Security 4688 | process | LAB-HOST$ | C:\Windows\System32\backgroundTaskHost.exe | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPPrinterControl.AppXg27tfcrjvepe7p6m0w5zs7c77x5b4h... | service/background parent or machine account |
| 2026-04-16T12:58:02.8668363-07:00 | Security 4688 | process | labuser | C:\Windows\System32\conhost.exe | conhost.exe <= wevtutil.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | interactive user account |
Full Raw Timeline (2246 normalized events)
| Time | Category | Source | Type | Summary | Detail |
|---|---|---|---|---|---|
| 2026-04-16T16:57:12.2964681-07:00 | likely_user | Security 4688 | process | Windows Notepad Installer.exe <= explorer.exe | "C:\Users\labuser\Downloads\Windows Notepad Installer.exe" | "C:\Users\labuser\Downloads\Windows Notepad Installer.exe" |
| 2026-04-16T16:56:06.9443720-07:00 | likely_user | Security 4688 | process | Taskmgr.exe <= explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | "C:\windows\system32\taskmgr.exe" /4 |
| 2026-04-16T16:54:01.4614101-07:00 | likely_user | Security 4688 | process | Taskmgr.exe <= explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | "C:\windows\system32\taskmgr.exe" /4 |
| 2026-04-16T16:45:21.0704054-07:00 | likely_user | Security 4688 | process | ai.exe <= WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "DD1E5E92-DC37-4A7D-84A1-7DB2C... | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "DD1E5E92-DC37-4A7D-84A1-7DB2CDD24AF5" "B5000976-3B00-474A-9E23-BF87F98AC9... |
| 2026-04-16T16:45:12.7882833-07:00 | likely_user | Security 4688 | process | ai.exe <= WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "B7FE164E-4CCE-4502-AD82-E6D18... | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "B7FE164E-4CCE-4502-AD82-E6D181ECAB16" "B5000976-3B00-474A-9E23-BF87F98AC9... |
| 2026-04-16T16:45:12.3206527-07:00 | likely_user | Security 4688 | process | aimgr.exe <= WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\aimgr.exe" | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\aimgr.exe" |
| 2026-04-16T16:45:12.2917914-07:00 | likely_user | Security 4688 | process | aimgr.exe <= WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\aimgr.exe" | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\aimgr.exe" |
| 2026-04-16T16:45:11.3249009-07:00 | likely_user | Security 4688 | process | WINWORD.EXE <= explorer.exe | "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE" | "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE" |
| 2026-04-16T14:11:05.4295475-07:00 | likely_user | PowerShell 4104 | scriptblock | Remove-Item "$env:USERPROFILE\Desktop\ir_file_test_renamed.txt" | Remove-Item "$env:USERPROFILE\Desktop\ir_file_test_renamed.txt" |
| 2026-04-16T14:10:58.2641530-07:00 | likely_user | PowerShell 4104 | scriptblock | Rename-Item "$env:USERPROFILE\Desktop\ir_file_test.txt" "ir_file_test_renamed.txt" | Rename-Item "$env:USERPROFILE\Desktop\ir_file_test.txt" "ir_file_test_renamed.txt" |
| 2026-04-16T14:10:53.0971982-07:00 | likely_user | PowerShell 4104 | scriptblock | echo test > "$env:USERPROFILE\Desktop\ir_file_test.txt" | echo test > "$env:USERPROFILE\Desktop\ir_file_test.txt" |
| 2026-04-16T14:07:56.1522067-07:00 | likely_user | Security 4688 | process | reg.exe <= powershell.exe | "C:\windows\system32\reg.exe" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v IRTestRun /f | "C:\windows\system32\reg.exe" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v IRTestRun /f |
| 2026-04-16T14:07:56.1513289-07:00 | likely_user | PowerShell 4104 | scriptblock | reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v IRTestRun /f | reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v IRTestRun /f |
| 2026-04-16T14:07:50.5459539-07:00 | likely_user | Security 4688 | process | reg.exe <= powershell.exe | "C:\windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v IRTestRun /t REG_SZ /d notepad.exe /f | "C:\windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v IRTestRun /t REG_SZ /d notepad.exe /f |
| 2026-04-16T14:07:50.5450904-07:00 | likely_user | PowerShell 4104 | scriptblock | reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v IRTestRun /t REG_SZ /d "notepad.exe" /f | reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v IRTestRun /t REG_SZ /d "notepad.exe" /f |
| 2026-04-16T14:07:41.3546549-07:00 | likely_user | Security 4688 | process | schtasks.exe <= powershell.exe | "C:\windows\system32\schtasks.exe" /delete /tn IRTestTask /f | "C:\windows\system32\schtasks.exe" /delete /tn IRTestTask /f |
| 2026-04-16T14:07:41.3538042-07:00 | likely_user | PowerShell 4104 | scriptblock | schtasks /delete /tn IRTestTask /f | schtasks /delete /tn IRTestTask /f |
| 2026-04-16T14:07:30.4719301-07:00 | likely_user | Security 4688 | process | schtasks.exe <= powershell.exe | "C:\windows\system32\schtasks.exe" /create /sc once /tn IRTestTask /tr notepad.exe /st 23:59 /f | "C:\windows\system32\schtasks.exe" /create /sc once /tn IRTestTask /tr notepad.exe /st 23:59 /f |
| 2026-04-16T14:07:30.4709468-07:00 | likely_user | PowerShell 4104 | scriptblock | schtasks /create /sc once /tn IRTestTask /tr "notepad.exe" /st 23:59 /f | schtasks /create /sc once /tn IRTestTask /tr "notepad.exe" /st 23:59 /f |
| 2026-04-16T14:07:07.0576214-07:00 | likely_user | Security 4688 | process | NETSTAT.EXE <= powershell.exe | "C:\windows\system32\NETSTAT.EXE" -ano | "C:\windows\system32\NETSTAT.EXE" -ano |
| 2026-04-16T14:07:07.0553429-07:00 | likely_user | PowerShell 4104 | scriptblock | netstat -ano | netstat -ano |
| 2026-04-16T14:07:02.1141920-07:00 | likely_user | Security 4688 | process | whoami.exe <= powershell.exe | "C:\windows\system32\whoami.exe" /all | "C:\windows\system32\whoami.exe" /all |
| 2026-04-16T14:07:02.1131368-07:00 | likely_user | PowerShell 4104 | scriptblock | whoami /all | whoami /all |
| 2026-04-16T14:06:57.2988993-07:00 | likely_user | Security 4688 | process | ipconfig.exe <= powershell.exe | "C:\windows\system32\ipconfig.exe" /all | "C:\windows\system32\ipconfig.exe" /all |
| 2026-04-16T14:06:57.2979833-07:00 | likely_user | PowerShell 4104 | scriptblock | ipconfig /all | ipconfig /all |
| 2026-04-16T14:06:50.7902724-07:00 | likely_user | Security 4688 | process | schtasks.exe <= powershell.exe | "C:\windows\system32\schtasks.exe" /query | "C:\windows\system32\schtasks.exe" /query |
| 2026-04-16T14:06:50.7893683-07:00 | likely_user | PowerShell 4104 | scriptblock | schtasks /query | schtasks /query |
| 2026-04-16T14:06:43.6075774-07:00 | likely_user | Security 4688 | process | reg.exe <= powershell.exe | "C:\windows\system32\reg.exe" query HKCU\Software | "C:\windows\system32\reg.exe" query HKCU\Software |
| 2026-04-16T14:06:43.6065777-07:00 | likely_user | PowerShell 4104 | scriptblock | reg query HKCU\Software | reg query HKCU\Software |
| 2026-04-16T14:06:34.5377140-07:00 | likely_user | Security 4688 | process | Taskmgr.exe <= powershell.exe | "C:\windows\system32\Taskmgr.exe" | "C:\windows\system32\Taskmgr.exe" |
| 2026-04-16T14:06:34.5367202-07:00 | likely_user | PowerShell 4104 | scriptblock | taskmgr.exe | taskmgr.exe |
| 2026-04-16T14:06:28.9009668-07:00 | likely_user | PowerShell 4104 | scriptblock | Get-StartApps | Get-StartApps |
| 2026-04-16T14:06:01.0964483-07:00 | likely_user | PowerShell 4104 | scriptblock | Get-Process | Select-Object -First 5 | Get-Process | Select-Object -First 5 |
| 2026-04-16T14:06:00.8308323-07:00 | likely_user | Security 4688 | process | powershell.exe <= powershell.exe | "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Get-Process | Select-Object -First 5" | "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Get-Process | Select-Object -First 5" |
| 2026-04-16T14:06:00.8273074-07:00 | likely_user | PowerShell 4104 | scriptblock | Start-Process powershell.exe -ArgumentList '-NoProfile -Command "Get-Process | Select-Object -First 5"' | Start-Process powershell.exe -ArgumentList '-NoProfile -Command "Get-Process | Select-Object -First 5"' |
| 2026-04-16T14:05:54.3257807-07:00 | likely_user | PowerShell 4104 | scriptblock | Invoke-WebRequest -Uri "https://example.com" -OutFile "$env:USERPROFILE\Desktop\example_test.html" | Invoke-WebRequest -Uri "https://example.com" -OutFile "$env:USERPROFILE\Desktop\example_test.html" |
| 2026-04-16T14:05:47.6415047-07:00 | likely_user | Security 4688 | process | cmd.exe <= powershell.exe | "C:\windows\system32\cmd.exe" /c echo test-from-cmd > "$env:USERPROFILE\Desktop\ir_test_cmd.txt" | "C:\windows\system32\cmd.exe" /c echo test-from-cmd > "$env:USERPROFILE\Desktop\ir_test_cmd.txt" |
| 2026-04-16T14:05:47.6081782-07:00 | likely_user | PowerShell 4104 | scriptblock | Start-Process cmd.exe -ArgumentList '/c echo test-from-cmd > "$env:USERPROFILE\Desktop\ir_test_cmd.txt"' | Start-Process cmd.exe -ArgumentList '/c echo test-from-cmd > "$env:USERPROFILE\Desktop\ir_test_cmd.txt"' |
| 2026-04-16T14:05:27.7254801-07:00 | likely_user | Security 4688 | process | Notepad.exe <= Notepad.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" /SESSION:XHqjvG+npU+... | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" /SESSION:XHqjvG+npU+27TfBmUH1HgAAAAABFAABzCIAAG+npU8MAwAAAAAAAA== |
| 2026-04-16T14:05:27.6957006-07:00 | likely_user | Security 4688 | process | Notepad.exe <= powershell.exe | "C:\windows\system32\notepad.exe" | "C:\windows\system32\notepad.exe" |
| 2026-04-16T14:05:27.6772009-07:00 | likely_user | PowerShell 4104 | scriptblock | notepad.exe | notepad.exe |
| 2026-04-16T14:05:21.5848398-07:00 | likely_user | Security 4688 | process | powershell.exe <= WindowsTerminal.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| 2026-04-16T14:05:21.1789212-07:00 | likely_user | Security 4688 | process | wt.exe <= explorer.exe | "C:\Users\labuser\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe" -p {61c54bbd-c2c6-5271-96e7-009a... | "C:\Users\labuser\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe" -p {61c54bbd-c2c6-5271-96e7-009a87ff44bf} |
| 2026-04-16T14:03:29.1192334-07:00 | likely_user | Security 4688 | process | Wireshark.exe <= explorer.exe | "C:\Program Files\Wireshark\Wireshark.exe" | "C:\Program Files\Wireshark\Wireshark.exe" |
| 2026-04-16T14:03:17.7096708-07:00 | likely_user | Security 4688 | process | Notepad.exe <= Notepad.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" |
| 2026-04-16T14:03:08.3167830-07:00 | likely_user | Security 4688 | process | Taskmgr.exe <= explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | "C:\windows\system32\taskmgr.exe" /4 |
| 2026-04-16T14:01:13.0703067-07:00 | likely_user | Security 4688 | process | bdtrackersnmh.exe <= cmd.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe" chrome-extension://khndhdhbebhaddchcgnalcjlaekbbeof... | "C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe" chrome-extension://khndhdhbebhaddchcgnalcjlaekbbeof/ --parent-window=0 |
| 2026-04-16T14:01:13.0255373-07:00 | likely_user | Security 4688 | process | cmd.exe <= chrome.exe | C:\windows\system32\cmd.exe /d /s /c ""C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe" chrome-extension://kh... | C:\windows\system32\cmd.exe /d /s /c ""C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe" chrome-extension://khndhdhbebhaddchcgnalcjlaekbbeof/ --parent-win... |
| 2026-04-16T14:01:10.1114778-07:00 | likely_user | Security 4688 | process | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" | "C:\Program Files\Google\Chrome\Application\chrome.exe" |
| 2026-04-16T14:00:57.6545590-07:00 | likely_user | Security 4688 | process | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" | "C:\Program Files\Google\Chrome\Application\chrome.exe" |
| 2026-04-16T13:42:16.0972948-07:00 | likely_user | Security 4688 | process | Notepad.exe <= Notepad.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\Desk... | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR-20260416-1330... |
| 2026-04-16T13:42:01.2918435-07:00 | likely_user | Security 4688 | process | Taskmgr.exe <= explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | "C:\windows\system32\taskmgr.exe" /4 |
| 2026-04-16T17:00:59.3619195-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3617683-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3617585-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3617211-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3616974-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3616783-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3616688-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3616590-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3615793-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3615700-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3615607-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3615443-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3613657-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.361", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3607183-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3607032-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3606937-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3606783-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3606688-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3606477-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3606315-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3606223-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3606125-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3605657-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3605563-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3605407-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3605307-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3604880-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3604604-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3604443-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3604350-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3604247-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3602804-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3602710-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3602604-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3602079-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.360", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3600381-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.359", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3572419-07:00 | background | Sysmon 10 | other | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:59.356", "SourceProcessGUID": "{0d32142e-bf2d-69df-1a00-000000007700}", "SourceProcessId": "253... |
| 2026-04-16T17:00:59.3568762-07:00 | background | Sysmon 10 | other | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:59.356", "SourceProcessGUID": "{0d32142e-bf2d-69df-1a00-000000007700}", "SourceProcessId": "253... |
| 2026-04-16T17:00:59.3566771-07:00 | background | Sysmon 10 | other | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:59.355", "SourceProcessGUID": "{0d32142e-bf2d-69df-1a00-000000007700}", "SourceProcessId": "253... |
| 2026-04-16T17:00:59.3559050-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Pub... | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.355", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3527198-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher\CTLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.352", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3527105-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher\CRLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.352", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3526949-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher\Certificates | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.352", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3526836-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.352", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3526741-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.352", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3526518-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3526365-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3526274-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3526178-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3525978-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3525883-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3524348-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3524252-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3523749-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3523656-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3523560-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3523209-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3523111-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3521638-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3521546-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3521448-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3520923-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3519310-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPublisher | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.351", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3513883-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3513728-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3513633-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3513483-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3513388-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3513159-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3513009-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3512913-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3512812-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3512330-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3512154-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3512001-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3511901-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3511476-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3511207-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3511042-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3510948-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3510848-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3509835-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3509742-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3509644-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3509474-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.350", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3506221-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.349", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:59.3437401-07:00 | background | Sysmon 10 | other | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:59.343", "SourceProcessGUID": "{0d32142e-bf2d-69df-1a00-000000007700}", "SourceProcessId": "253... |
| 2026-04-16T17:00:59.3432910-07:00 | background | Sysmon 10 | other | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:59.342", "SourceProcessGUID": "{0d32142e-bf2d-69df-1a00-000000007700}", "SourceProcessId": "253... |
| 2026-04-16T17:00:59.3430565-07:00 | background | Sysmon 10 | other | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:59.342", "SourceProcessGUID": "{0d32142e-bf2d-69df-1a00-000000007700}", "SourceProcessId": "253... |
| 2026-04-16T17:00:59.3414373-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Pub... | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.340", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:59.3002706-07:00 | background | Sysmon 17 | other | OmenCommandCenterBackground.exe created pipe \PerformanceControlPerformanceMonitorBgGPU_SIMPLE2 | Named pipe creation visibility :: {"RuleName": "-", "EventType": "CreatePipe", "UtcTime": "2026-04-17 00:00:59.299", "ProcessGuid": "{0d32142e-2632-69e1-2b13-000000007700}", "Pr... |
| 2026-04-16T17:00:59.2996657-07:00 | background | Sysmon 18 | other | OmenCommandCenterBackground.exe connected to pipe \PerformanceControlPerformanceMonitorBgGPU_SIMPLE2 | Named pipe connection visibility :: {"RuleName": "-", "EventType": "ConnectPipe", "UtcTime": "2026-04-17 00:00:59.298", "ProcessGuid": "{0d32142e-2632-69e1-2b13-000000007700}", ... |
| 2026-04-16T17:00:59.2728054-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\System\CurrentControlSet\Services\Tcpip\Parameters | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.272", "ProcessGuid": "{0d32142e-bf2d-69df-2000-000000007700}", "... |
| 2026-04-16T17:00:59.1792856-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c2a3f323-ae1a-405a-8908-8deccd680a54} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:59.179", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.1790338-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{a8f6aa25-3875-4314-a9ec-96f4c7de01ec} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:59.178", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.1785684-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{863b8238-6e94-4ed2-b697-f2d8d6ef254e} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:59.178", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.1784329-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{8b5346a4-d36e-40e2-bfbc-759efb7bd400} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:59.178", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.1775684-07:00 | background | Sysmon 13 | other | Registry change (SetValue) HKLM\SYSTEM\Software\Microsoft\TIP\AggregateResults\data | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.177", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1774414-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SYSTEM\Software\Microsoft\TIP\AggregateResults | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.177", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:59.1773828-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SYSTEM\Software\Microsoft\TIP\AggregateResults | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.177", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:59.1773673-07:00 | background | Sysmon 13 | other | Registry change (SetValue) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\State | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.177", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1772725-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.177", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:59.1772611-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:59.177", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:59.1772008-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.177", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:59.1771055-07:00 | background | Sysmon 13 | other | Registry change (SetValue) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Maintenance | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.176", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1770137-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.176", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:59.1769973-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.176", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:59.1762209-07:00 | background | Sysmon 18 | other | powershell.EXE connected to pipe \{7FCB1218-D9DD-4E13-91C0-4EE04F8B8C90} | Named pipe connection visibility :: {"RuleName": "-", "EventType": "ConnectPipe", "UtcTime": "2026-04-17 00:00:59.176", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", ... |
| 2026-04-16T17:00:59.1749771-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\EventType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1749609-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\EventType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1747392-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\EventType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1746993-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\ExtendedRegistrationData | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1746683-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\PackageFlags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1746428-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\PsmActivationType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1746150-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\PackageRelativeAppName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1745882-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\TaskEntryPoint | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1745578-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\TriggerEvent | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1745274-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\Name | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1744982-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1744667-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\Conditions | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1744321-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e}\ActivationType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1743834-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{6d65fc6f-bad4-4f11-9620-501d0d20c97e} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.174", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.1688201-07:00 | background | Sysmon 10 | other | svchost.exe accessed svchost.exe (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:59.168", "SourceProcessGUID": "{0d32142e-bf2d-69df-1400-000000007700}", "SourceProcessId": "230... |
| 2026-04-16T17:00:59.1684193-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\UserSid | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.168", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1683931-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\PackageFullName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.168", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1683262-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.168", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1682965-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\EventParameters | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.168", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1682725-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b}\BrokerId | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.168", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1682351-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{7bfd87eb-14e2-4f7f-a969-fd1290f3032b} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.168", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.1594490-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\UserSid | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.159", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1594396-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\PackageFullName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.159", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1594302-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.159", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1594206-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\EventParameters | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.159", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1594106-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58}\BrokerId | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.159", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1593942-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{0a2370d2-da1b-4d76-b29e-0fd0bf7bfa58} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.159", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.1377636-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\UserSid | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.137", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1377435-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\PackageFullName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.137", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1377224-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.137", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1377016-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\EventParameters | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.137", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1376794-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0}\BrokerId | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.137", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1376461-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f1c3c963-74cb-4740-8e06-b95031f9eda0} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.136", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.1131103-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\EventType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.112", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1130895-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\EventType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.112", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1130641-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\EventType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.112", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1127058-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\ExtendedRegistrationData | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.112", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1126855-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\PackageFlags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.112", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1126656-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\PsmActivationType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.112", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1126456-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\PackageRelativeAppName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.112", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1126248-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\TaskEntryPoint | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.111", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1126044-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\TriggerEvent | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.111", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1125837-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\Name | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.111", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1125626-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.111", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1125415-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\Conditions | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.111", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1125196-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be}\ActivationType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.111", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1124905-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{879baf88-ac40-4bd2-9d3c-3d4e9e5a77be} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.111", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.1014773-07:00 | background | Sysmon 10 | other | svchost.exe accessed svchost.exe (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:59.100", "SourceProcessGUID": "{0d32142e-bf2d-69df-1400-000000007700}", "SourceProcessId": "230... |
| 2026-04-16T17:00:59.1011033-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\UserSid | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.100", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1010799-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\PackageFullName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.100", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1010590-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.100", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1010340-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\EventParameters | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.100", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1010109-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47}\BrokerId | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.100", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.1009822-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{2769fb90-0beb-4323-9908-e686fc46cf47} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.100", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.0791608-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\UserSid | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.078", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0791397-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\PackageFullName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.078", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0791084-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.078", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0790865-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\EventParameters | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.078", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0790556-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b}\BrokerId | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.078", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0790100-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{323b5c5a-ce48-4029-8805-f6ddddf28b2b} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.078", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.0577956-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\UserSid | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.057", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0577756-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\PackageFullName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.057", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0577534-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.057", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0577324-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\EventParameters | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.057", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0577103-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1}\BrokerId | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.057", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0576798-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{c7ddaf7d-64a1-4e7a-9a4d-fc1a78734ad1} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.057", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.0351094-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:59.035", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.0349844-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:59.034", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.0348323-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:59.034", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.0347927-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:59.034", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.0326575-07:00 | background | Sysmon 13 | other | Registry change (SetValue) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\State | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.032", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0325996-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.032", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:59.0325793-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:59.032", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:59.0325562-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.032", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:59.0319991-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\EventType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0319795-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\EventType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0319602-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\EventType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0319405-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\ExtendedRegistrationData | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0319206-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\PackageFlags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0319011-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\PsmActivationType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0318811-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\PackageRelativeAppName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0318604-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\TaskEntryPoint | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0318405-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\TriggerEvent | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0318201-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\Name | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0317996-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0317792-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\Conditions | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0317582-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564}\ActivationType | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0317280-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{80287cf8-f192-4c32-bc07-316e8a078564} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.031", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.0193156-07:00 | background | Sysmon 10 | other | svchost.exe accessed svchost.exe (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:59.019", "SourceProcessGUID": "{0d32142e-bf2d-69df-1400-000000007700}", "SourceProcessId": "230... |
| 2026-04-16T17:00:59.0190928-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\UserSid | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.018", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0190639-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\PackageFullName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.018", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0187952-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.018", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0187749-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\EventParameters | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.018", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0187535-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a}\BrokerId | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:59.018", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:59.0187277-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{787bb155-3f9b-418c-a8dd-77f6c00e179a} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:59.018", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:59.0086771-07:00 | background | Sysmon 17 | other | OmenCommandCenterBackground.exe created pipe \HP.Omen.Features.Services.Games.Background.GamePerformanceStatics2 | Named pipe creation visibility :: {"RuleName": "-", "EventType": "CreatePipe", "UtcTime": "2026-04-17 00:00:59.008", "ProcessGuid": "{0d32142e-2632-69e1-2b13-000000007700}", "Pr... |
| 2026-04-16T17:00:59.0081914-07:00 | background | Sysmon 18 | other | OverlayHelper.exe connected to pipe \HP.Omen.Features.Services.Games.Background.GamePerformanceStatics2 | Named pipe connection visibility :: {"RuleName": "-", "EventType": "ConnectPipe", "UtcTime": "2026-04-17 00:00:59.007", "ProcessGuid": "{0d32142e-2629-69e1-cb12-000000007700}", ... |
| 2026-04-16T17:00:58.9994853-07:00 | background | Sysmon 10 | other | Code.exe accessed Code.exe (GrantedAccess 0x101401) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.999", "SourceProcessGUID": "{0d32142e-2bd2-69e1-ed15-000000007700}", "SourceProcessId": "264... |
| 2026-04-16T17:00:58.9981556-07:00 | background | Sysmon 18 | other | powershell.EXE connected to pipe \{7FCB1218-D9DD-4E13-91C0-4EE04F8B8C90} | Named pipe connection visibility :: {"RuleName": "-", "EventType": "ConnectPipe", "UtcTime": "2026-04-17 00:00:58.998", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", ... |
| 2026-04-16T17:00:58.9971626-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\UserSid | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:58.997", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:58.9970667-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\PackageFullName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:58.997", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:58.9970214-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:58.996", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:58.9969924-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\EventParameters | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:58.996", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:58.9969633-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45}\BrokerId | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:58.996", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:58.9969166-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{4e9df57d-9ede-4841-9244-aa875add5b45} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.996", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:58.9881594-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\UserSid | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:58.988", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:58.9881343-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\PackageFullName | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:58.988", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:58.9881072-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\Flags | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:58.988", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:58.9880732-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\EventParameters | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:58.988", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:58.9880484-07:00 | background | Sysmon 13 | other | Registry change (SetValue) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345}\BrokerId | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:58.988", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "Proce... |
| 2026-04-16T17:00:58.9880284-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{d3d8e946-1219-43de-b6eb-93eee6a03345} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.987", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:58.9772269-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{5ef5dfb7-acb1-45a1-9e15-7f7a408bef14} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:58.977", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:58.9769424-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{f247a6b9-6c24-437b-913a-f1fe9b8aec39} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:58.976", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:58.9767754-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\Events\{ee6c63ac-ec61-412f-85d1-2bcfb509220f} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:58.976", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:58.9766731-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) \REGISTRY\A\{f85bdcdb-75fb-446d-8d87-5f2dfe451387}\WorkItems\{fef54999-0247-44ab-8281-b21e3eea1d1e} | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:58.976", "ProcessGuid": "{0d32142e-bf2d-69df-0f00-000000007700}", "... |
| 2026-04-16T17:00:58.9739507-07:00 | background | Sysmon 13 | other | Registry change (SetValue) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Settings\SpotlightDis... | Registry value set visibility :: {"RuleName": "-", "EventType": "SetValue", "UtcTime": "2026-04-17 00:00:58.972", "ProcessGuid": "{0d32142e-262c-69e1-fe12-000000007700}", "Proce... |
| 2026-04-16T17:00:58.9739199-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Settings | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.972", "ProcessGuid": "{0d32142e-262c-69e1-fe12-000000007700}", "... |
| 2026-04-16T17:00:58.9725387-07:00 | background | Sysmon 10 | other | RuntimeBroker.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.972", "SourceProcessGUID": "{0d32142e-262c-69e1-fe12-000000007700}", "SourceProcessId": "224... |
| 2026-04-16T17:00:58.9707730-07:00 | background | Sysmon 18 | other | powershell.EXE connected to pipe \{7FCB1218-D9DD-4E13-91C0-4EE04F8B8C90} | Named pipe connection visibility :: {"RuleName": "-", "EventType": "ConnectPipe", "UtcTime": "2026-04-17 00:00:58.969", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", ... |
| 2026-04-16T17:00:58.9703050-07:00 | background | Sysmon 12 | other | Registry change (DeleteKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | Registry create/delete visibility :: {"RuleName": "-", "EventType": "DeleteKey", "UtcTime": "2026-04-17 00:00:58.969", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:58.9702745-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\DesktopSpotlight\Permission | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.969", "ProcessGuid": "{0d32142e-783a-69e1-a81a-000000007700}", "... |
| 2026-04-16T17:00:58.9668802-07:00 | background | Sysmon 10 | other | svchost.exe accessed powershell.EXE (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.966", "SourceProcessGUID": "{0d32142e-bf2d-69df-3b00-000000007700}", "SourceProcessId": "458... |
| 2026-04-16T17:00:58.9662798-07:00 | background | Sysmon 10 | other | svchost.exe accessed powershell.EXE (GrantedAccess 0x1478) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.966", "SourceProcessGUID": "{0d32142e-bf2d-69df-3b00-000000007700}", "SourceProcessId": "458... |
| 2026-04-16T17:00:58.9596310-07:00 | background | Sysmon 10 | other | lsass.exe accessed powershell.EXE (GrantedAccess 0x1478) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.958", "SourceProcessGUID": "{0d32142e-bf2d-69df-0e00-000000007700}", "SourceProcessId": "147... |
| 2026-04-16T17:00:58.9595642-07:00 | background | Sysmon 10 | other | lsass.exe accessed powershell.EXE (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.958", "SourceProcessGUID": "{0d32142e-bf2d-69df-0e00-000000007700}", "SourceProcessId": "147... |
| 2026-04-16T17:00:58.9469898-07:00 | background | Sysmon 17 | other | powershell.EXE created pipe \PSHost.134208576588429941.32680.DefaultAppDomain.powershell | Named pipe creation visibility :: {"RuleName": "-", "EventType": "CreatePipe", "UtcTime": "2026-04-17 00:00:58.946", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "Pr... |
| 2026-04-16T17:00:58.9377932-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.937", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9377649-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.937", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9377339-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed powershell.EXE (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.937", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9376300-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed powershell.EXE (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.937", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9376017-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed wmiprvse.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.937", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9375690-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed wmiprvse.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.936", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9374547-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed python.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.936", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9374071-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed python.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.936", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9373241-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Windows Notepad Installer.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.936", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9372726-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Windows Notepad Installer.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.936", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9372049-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.936", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9371525-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.936", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9370782-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.936", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9370501-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.936", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9370095-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed CHXSmartScreen.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.936", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9368791-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed CHXSmartScreen.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.935", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9367487-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed smartscreen.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.935", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9367218-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed smartscreen.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.935", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9366945-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.935", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9366665-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.935", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9366382-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.935", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9366085-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.935", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9365443-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.935", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9363793-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9363524-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9363264-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9363003-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9362733-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9362472-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed wwahost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9362204-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed wwahost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9361947-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9361678-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9361425-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9361157-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9360889-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9360629-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9360362-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9360022-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9359756-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed BackgroundTaskHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.934", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9359480-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed BackgroundTaskHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.933", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9359163-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed AccountsControlHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.933", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9343503-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed AccountsControlHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.933", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9342905-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed wmiprvse.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.933", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9341810-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed wmiprvse.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.933", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9341532-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HPSystemEventUtilityHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.933", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9341252-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HPSystemEventUtilityHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.933", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9340959-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.933", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9340626-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.933", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9340353-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9340150-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9339946-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9339737-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9339529-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed LockApp.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.933", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9339245-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9339038-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9338826-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9338622-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9338413-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9338208-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9338001-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9337787-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed LockApp.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.933", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9337508-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9337300-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9337089-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9336884-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9336675-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9336465-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9336250-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.933", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9336039-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed TouchpointAnalyticsClient.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9335756-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.932", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9335552-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.932", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9335307-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed TouchpointAnalyticsClient.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9334903-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.932", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9334701-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.932", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9334496-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9334209-07:00 | background | Sysmon 26 | other | Deleted file detected: C:\Users\labuser\AppData\Local\Temp\__PSScriptPolicyTest_5odocrti.n3u.psm1 | File delete detected visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "ProcessId": "32680", "User":... |
| 2026-04-16T17:00:58.9333948-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.932", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9333690-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9333079-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed UserOOBEBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9332447-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed UserOOBEBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9332177-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9331915-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9331652-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9331389-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed DllHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9331124-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9330859-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9330593-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9330327-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9330062-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9329793-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9329521-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9329227-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9325547-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9325196-07:00 | background | Sysmon 26 | other | Deleted file detected: C:\Users\labuser\AppData\Local\Temp\__PSScriptPolicyTest_nnlb2lxj.pim.ps1 | File delete detected visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.932", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "ProcessId": "32680", "User":... |
| 2026-04-16T17:00:58.9324929-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9324633-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed pwsh.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9323609-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed pwsh.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9322949-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9322371-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9321677-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9321181-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9320527-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed pet.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9320250-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed pet.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9319947-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed pwsh.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9319677-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed pwsh.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9319409-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9319133-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9318850-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9318570-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.931", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9318295-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9317992-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9317685-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9317403-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9317122-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9316830-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9316518-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9316224-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9315928-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9315076-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9314803-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Pub... | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.930", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9314568-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9314294-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9314024-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9313753-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9313480-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9313208-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Code.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9312926-07:00 | background | Sysmon 10 | other | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2d-69df-3b00-000000007700}", "SourceProcessId": "458... |
| 2026-04-16T17:00:58.9312618-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.930", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9312349-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9312077-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ShellExperienceHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9311807-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ShellExperienceHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9311540-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ShellHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9311266-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ShellHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9310987-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9310711-07:00 | background | Sysmon 10 | other | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1478) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2d-69df-3b00-000000007700}", "SourceProcessId": "458... |
| 2026-04-16T17:00:58.9310388-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9310110-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed AppActions.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9309835-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed AppActions.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9309545-07:00 | background | Sysmon 10 | other | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2d-69df-1a00-000000007700}", "SourceProcessId": "253... |
| 2026-04-16T17:00:58.9309017-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9305180-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9304907-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9304622-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9304349-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9304069-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.929", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9303793-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bdtrackersnmh.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.928", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9303492-07:00 | background | Sysmon 10 | other | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.928", "SourceProcessGUID": "{0d32142e-bf2d-69df-1a00-000000007700}", "SourceProcessId": "253... |
| 2026-04-16T17:00:58.9303077-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bdtrackersnmh.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.928", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9302802-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.928", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9302516-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.928", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9302233-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed cmd.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.928", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9301948-07:00 | background | Sysmon 10 | other | svchost.exe accessed powershell.EXE (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.928", "SourceProcessGUID": "{0d32142e-bf2d-69df-1a00-000000007700}", "SourceProcessId": "253... |
| 2026-04-16T17:00:58.9301494-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed cmd.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.928", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9301210-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.928", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9300934-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.928", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9300660-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.928", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9300385-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.927", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9300114-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.927", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9299837-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.927", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9299564-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.927", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9299288-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.927", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9299017-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.927", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9298742-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.927", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9298462-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9298183-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed chrome.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9297911-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ApplicationFrameHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9297636-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ApplicationFrameHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9297363-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9297088-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9296813-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9296534-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9296253-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HPEnhancedLighting.Bg.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9295973-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HPEnhancedLighting.Bg.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9295692-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9295416-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9295141-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9294857-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9294573-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.926", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9294288-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9294008-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9293730-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9293381-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9293051-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9292774-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9292495-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9292221-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9291943-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9291665-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9291386-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVIDIA Broadcast.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9291112-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9290838-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.925", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9290563-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9290285-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9290011-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed crashpad_handler.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9289730-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed crashpad_handler.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9289452-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9289178-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9288897-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ShureDeviceManager.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9288607-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ShureDeviceManager.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9288283-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9287799-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9287532-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9287264-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9286991-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9286724-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9286452-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9286175-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed MOTIV Mix.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9285903-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RtkAudUService64.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.924", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9285627-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RtkAudUService64.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9285277-07:00 | background | Sysmon 10 | other | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x101000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2d-69df-0f00-000000007700}", "SourceProcessId": "206... |
| 2026-04-16T17:00:58.9284883-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9284611-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed conhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9284339-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HP.OMEN.VirtualCamHelper.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9284064-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HP.OMEN.VirtualCamHelper.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9283788-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed PhoneExperienceHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9283482-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed PhoneExperienceHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9283175-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ReconsentNotification.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9282897-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ReconsentNotification.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9282618-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9282343-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9282064-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed TextInputHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.923", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9281790-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed TextInputHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.922", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9281514-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HPMediaNetwork.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.922", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9281237-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HPMediaNetwork.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.922", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9280965-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Pub... | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9280748-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed unsecapp.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.922", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9280471-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed unsecapp.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.922", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9280197-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CTLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9279984-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CRLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9279772-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\Certificates | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9279557-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HPSystemEventUtilityBackground.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.922", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9279265-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9279054-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9278838-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HPSystemEventUtilityBackground.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.922", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9278521-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9278314-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9278109-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9277898-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\trust | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9277692-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9277481-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9277274-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9277064-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\trust | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9276856-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\trust | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9276645-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\trust\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9276436-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\trust\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9276229-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\trust\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9276021-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\trust | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9275809-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\trust\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9275600-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\trust\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9275388-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\trust\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9275122-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\trust | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9274913-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\trust | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9274699-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CTLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9274484-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CRLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9274270-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\Certificates | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9274028-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9272209-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9272002-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9271796-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9271586-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9271373-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9271166-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.922", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9270952-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9270741-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9270529-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9270321-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9270110-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9269902-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9269695-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9269478-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPeople | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9269268-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9269056-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9268844-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9268634-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPeople | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9268413-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\TrustedPeople | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9268137-07:00 | background | Sysmon 10 | other | sihost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x101000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.921", "SourceProcessGUID": "{0d32142e-2629-69e1-c012-000000007700}", "SourceProcessId": "105... |
| 2026-04-16T17:00:58.9261755-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9261543-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9261328-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9261119-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\SmartCardRoot | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9260895-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9260675-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9260453-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9260240-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9260025-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CTLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9259809-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CRLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9259597-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9259378-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9259167-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9258947-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9258737-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9258521-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9258306-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9257802-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9257585-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9257360-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed OmenCommandCenterBackground.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.921", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9257049-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed OmenCommandCenterBackground.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.921", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9256738-07:00 | background | Sysmon 11 | other | powershell.EXE created file C:\Users\labuser\AppData\Local\Temp\__PSScriptPolicyTest_5odocrti.n3u.psm1 | File creation visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.921", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "ProcessId": "32680", "Image": "C:\\... |
| 2026-04-16T17:00:58.9256459-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bdagent.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.921", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9255971-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bdagent.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9255697-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9255427-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9255153-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ctfmon.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9254882-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed ctfmon.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9254606-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9254339-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9254062-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9253850-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9253636-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9253421-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9253148-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9252934-07:00 | background | Sysmon 11 | other | powershell.EXE created file C:\Users\labuser\AppData\Local\Temp\__PSScriptPolicyTest_nnlb2lxj.pim.ps1 | File creation visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "ProcessId": "32680", "Image": "C:\\... |
| 2026-04-16T17:00:58.9252706-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9252429-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9252148-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9251867-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9251590-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9251315-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9251099-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9250883-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9250668-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9250391-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9250114-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Root\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9249900-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Root\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9249685-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Root\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9249469-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9249193-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Root | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9248979-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed msedgewebview2.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9248700-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Root | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9248481-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.920", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9248199-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9247984-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9247700-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9247490-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.920", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9247277-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9247073-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9246857-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9246577-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9246367-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9246145-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9245858-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9245640-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9245400-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9244988-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9244353-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9244085-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9243885-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9243681-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9243471-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9243270-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9243011-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9242807-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9242591-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9242294-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9242090-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9241849-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9241578-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9241301-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9241089-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9240872-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed WidgetService.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9240599-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9240394-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9240184-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed WidgetService.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9239910-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\Disallowed | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9239700-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed StartMenuExperienceHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9239432-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed StartMenuExperienceHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9239163-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CTLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9238955-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CRLs | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9238752-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9238543-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed SearchHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9238273-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9238063-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", "... |
| 2026-04-16T17:00:58.9237855-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9237645-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed SearchHost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9237378-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9237173-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9236961-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\CA | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9236756-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9236545-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Widgets.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9236274-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.919", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9236062-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Widgets.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.919", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9235782-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9235509-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9235300-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\CA | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9235094-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RuntimeBroker.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9234824-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\CA | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9234613-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\CA\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9234404-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\CA\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9234193-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\CA\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9233982-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9233710-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Policies\Microsoft\SystemCertificates\CA | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9233498-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bduserhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9233226-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\CA\CTLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9233015-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\CA\CRLs | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9232802-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9232530-07:00 | background | Sysmon 18 | other | powershell.EXE connected to pipe \{7FCB1218-D9DD-4E13-91C0-4EE04F8B8C90} | Named pipe connection visibility :: {"RuleName": "-", "EventType": "ConnectPipe", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-000000007700}", ... |
| 2026-04-16T17:00:58.9232305-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9232035-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed CrossDeviceService.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9231762-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\CA\Certificates | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9231548-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed CrossDeviceService.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9231273-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\CA | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9231053-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed CrossDeviceResume.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9230755-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKU\S-1-5-21-1192498037-456795533-2332322264-1003\Software\Microsoft\SystemCertificates\CA | Likely certificate trust-store initialization :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.918", "ProcessGuid": "{0d32142e-783a-69e1-a71a-00000... |
| 2026-04-16T17:00:58.9230502-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed CrossDeviceResume.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9230133-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed taskhostw.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9229668-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed taskhostw.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.918", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9229390-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Explorer.EXE (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.917", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9229105-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed Explorer.EXE (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.917", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9228775-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed DiscoverySrv.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.917", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9228481-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed DiscoverySrv.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.917", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9228102-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed SystemOptimizer.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.917", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9227426-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed SystemOptimizer.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.917", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9226837-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed OmenInstallMonitor.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9226549-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed OmenInstallMonitor.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9226145-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed OverlayHelper.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9225520-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed OverlayHelper.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9225251-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9224981-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9224709-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9224387-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9224120-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9223851-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9223587-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed sihost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9223306-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed sihost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9222995-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed nvcontainer.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9221810-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed nvcontainer.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9221541-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9221275-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.916", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9221012-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed nvcontainer.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9220746-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed nvcontainer.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9220476-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVDisplay.Container.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9220206-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NVDisplay.Container.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9219920-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed dwm.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9219653-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed dwm.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9219364-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed fontdrvhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9219006-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.915", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9218783-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.915", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9200224-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.915", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9199520-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed fontdrvhost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9199245-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.915", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9199032-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed WinLogon.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9198759-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed WinLogon.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9198489-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9198212-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9197947-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9197677-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9197409-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9197133-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9196762-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.915", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9196553-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.915", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9196344-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.915", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9196136-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.915", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9195907-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.915", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9195526-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9192950-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed TouchpointGpuInfo.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9192679-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed TouchpointGpuInfo.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9192407-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9192141-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9191876-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9191605-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9191340-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed dashost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9191080-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.914", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9190881-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.914", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9190683-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.914", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9190479-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed dashost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9190226-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.914", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9190024-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9189768-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9189506-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9189243-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9188984-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9188724-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9188465-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9188203-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9187938-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.914", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9187738-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.914", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9187537-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.914", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9187335-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.914", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9187128-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.914", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9186858-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.913", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9186593-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bdredline.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.913", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9186328-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bdredline.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.913", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9186060-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.913", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9185860-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.913", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9185661-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.913", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9185464-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.913", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9185256-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bdredline.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.913", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9184990-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bdredline.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.913", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9184725-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.913", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9184464-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.913", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9184202-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed SearchIndexer.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.913", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9183939-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed SearchIndexer.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9183683-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.912", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9183479-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.912", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9183278-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.912", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9183077-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.912", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9182843-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9182578-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9182318-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9182058-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9181800-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9181533-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9181225-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9180959-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9180679-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9180398-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9179944-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9146805-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9146547-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.912", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9146335-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NgcIso.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9146071-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SecurityManager | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.912", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9145870-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.912", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9145666-07:00 | background | Sysmon 12 | other | Registry change (CreateKey) HKLM\SOFTWARE | Registry create/delete visibility :: {"RuleName": "-", "EventType": "CreateKey", "UtcTime": "2026-04-17 00:00:58.912", "ProcessGuid": "{0d32142e-bf2d-69df-1300-000000007700}", "... |
| 2026-04-16T17:00:58.9145426-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed NgcIso.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9145164-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.912", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9144898-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9144637-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9144375-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9144120-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9143856-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9143599-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9143340-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9143070-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9142806-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9142545-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bdntwrk.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9142282-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed bdntwrk.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9142018-07:00 | background | Sysmon 10 | other | lsass.exe accessed powershell.EXE (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2d-69df-0e00-000000007700}", "SourceProcessId": "147... |
| 2026-04-16T17:00:58.9141662-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed AUDIODG.EXE (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9141401-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed AUDIODG.EXE (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9141135-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed unsecapp.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9140862-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed unsecapp.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9140590-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9140313-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.911", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9140037-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9139765-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9139485-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9139198-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9138924-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9138609-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9116117-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9115750-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9110384-07:00 | background | Sysmon 10 | other | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x100000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2d-69df-1300-000000007700}", "SourceProcessId": "224... |
| 2026-04-16T17:00:58.9110073-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9109810-07:00 | background | Sysmon 10 | other | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x1000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2d-69df-0f00-000000007700}", "SourceProcessId": "206... |
| 2026-04-16T17:00:58.9109503-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9109245-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed dashost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9108985-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed dashost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9108720-07:00 | background | Sysmon 10 | other | svchost.exe accessed backgroundTaskHost.exe (GrantedAccess 0x101000) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2d-69df-0f00-000000007700}", "SourceProcessId": "206... |
| 2026-04-16T17:00:58.9108366-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed OfficeClickToRun.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9108097-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed OfficeClickToRun.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9107828-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9107564-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9107288-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed InstallerService.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.910", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9106886-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed InstallerService.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.909", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9104281-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HPCommRecovery.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.909", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9104021-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed HPCommRecovery.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.909", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9103762-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.909", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9103502-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed svchost.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.909", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9103249-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed XtuService.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.909", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9102995-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed XtuService.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.909", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9102738-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed updatesrv.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.909", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9102482-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed updatesrv.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.909", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9102225-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed WMIRegistrationService.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.909", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9101970-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed WMIRegistrationService.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.909", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9101714-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RtkAudUService64.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.908", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:58.9101452-07:00 | background | Sysmon 10 | other | wmiprvse.exe accessed RtkAudUService64.exe (GrantedAccess 0x1400) | Cross-process access visibility :: {"RuleName": "-", "UtcTime": "2026-04-17 00:00:58.908", "SourceProcessGUID": "{0d32142e-bf2f-69df-9e00-000000007700}", "SourceProcessId": "109... |
| 2026-04-16T17:00:55.9913467-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T17:00:55.8250090-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction Silen... |
| 2026-04-16T17:00:55.6639409-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T17:00:55.5799072-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T17:00:55.4005734-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T17:00:55.2473216-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... |
| 2026-04-16T17:00:55.0903941-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T17:00:54.8801520-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T17:00:54.7776773-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T17:00:54.6181291-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T17:00:54.4611469-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObject]... |
| 2026-04-16T17:00:54.2946294-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T17:00:49.0334156-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T17:00:48.9555284-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T17:00:48.7749048-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T17:00:48.6282033-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObjec... |
| 2026-04-16T17:00:48.4683388-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T17:00:48.2688361-07:00 | background | PowerShell 4104 | scriptblock | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... |
| 2026-04-16T17:00:48.2573382-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T17:00:48.1838464-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T17:00:48.0936266-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T17:00:48.0350454-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T17:00:47.9643617-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T17:00:47.8841439-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T17:00:47.8142641-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T17:00:47.7434358-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T17:00:47.6601405-07:00 | background | PowerShell 4104 | scriptblock | meterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { ... | meterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletizatio... |
| 2026-04-16T17:00:47.6601329-07:00 | background | PowerShell 4104 | scriptblock | lse { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'TrustLabelProtectionStatus'; ParameterType ... | lse { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'TrustLabelProtectionStatus'; ParameterType = 'System.Management... |
| 2026-04-16T17:00:47.6601251-07:00 | background | PowerShell 4104 | scriptblock | anagement.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} ... | anagement.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cm... |
| 2026-04-16T17:00:47.6601186-07:00 | background | PowerShell 4104 | scriptblock | [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSurfaceReductionRules_Actions'; ParameterType = 'Microsoft.PowerShell.Cmdletization.Gener... | [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSurfaceReductionRules_Actions'; ParameterType = 'Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreferen... |
| 2026-04-16T17:00:47.6601113-07:00 | background | PowerShell 4104 | scriptblock | ltAction'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdlet... | ltAction'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValue... |
| 2026-04-16T17:00:47.6601022-07:00 | background | PowerShell 4104 | scriptblock | ers.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = ... | ers.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if (... |
| 2026-04-16T17:00:47.6600957-07:00 | background | PowerShell 4104 | scriptblock | ll [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisablePrivacyMode')) { [object]$... | ll [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisablePrivacyMode')) { [object]$__cmdletization_valu... |
| 2026-04-16T17:00:47.6600881-07:00 | background | PowerShell 4104 | scriptblock | $__cmdletization_value = ${SignatureUpdateCatchupInterval} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]... | $__cmdletization_value = ${SignatureUpdateCatchupInterval} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureU... |
| 2026-04-16T17:00:47.6600804-07:00 | background | PowerShell 4104 | scriptblock | ValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ScanSched... | ValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ScanScheduleQuickScanTime'; P... |
| 2026-04-16T17:00:47.6600727-07:00 | background | PowerShell 4104 | scriptblock | 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPrese... | 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } ... |
| 2026-04-16T17:00:47.6600649-07:00 | background | PowerShell 4104 | scriptblock | ${RemediationScheduleDay} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'RemediationScheduleDay'... | ${RemediationScheduleDay} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'RemediationScheduleDay'; ParameterType = 'S... |
| 2026-04-16T17:00:47.6600570-07:00 | background | PowerShell 4104 | scriptblock | eNotNullOrEmpty()] [switch] ${EnableDnsSinkhole}, [Parameter(ParameterSetName='Remove2')] [Alias('dicf')] [ValidateNotNull()] ... | eNotNullOrEmpty()] [switch] ${EnableDnsSinkhole}, [Parameter(ParameterSetName='Remove2')] [Alias('dicf')] [ValidateNotNull()] [ValidateNotNullOrE... |
| 2026-04-16T17:00:47.6600504-07:00 | background | PowerShell 4104 | scriptblock | [Alias('sigui')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${SignatureUpdateInterval}, [Parameter(ParameterSetName='... | [Alias('sigui')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${SignatureUpdateInterval}, [Parameter(ParameterSetName='Remove2')] [Ali... |
| 2026-04-16T17:00:47.6600438-07:00 | background | PowerShell 4104 | scriptblock | cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionExclusions')) { [object]$__cmd... | cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionExclusions')) { [object]$__cmdletization_value = $... |
| 2026-04-16T17:00:47.6600364-07:00 | background | PowerShell 4104 | scriptblock | clusionExtension')) { [object]$__cmdletization_value = ${ExclusionExtension} $__cmdletization_methodParameter = [Microsoft.PowerShell.C... | clusionExtension')) { [object]$__cmdletization_value = ${ExclusionExtension} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodP... |
| 2026-04-16T17:00:47.6600271-07:00 | background | PowerShell 4104 | scriptblock | _cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false ... | _cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundPa... |
| 2026-04-16T17:00:47.6600190-07:00 | background | PowerShell 4104 | scriptblock | on_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ScanScheduleOffset'; ParameterType = 'System.UInt32'; Bindings = 'In'; Val... | on_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ScanScheduleOffset'; ParameterType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletizatio... |
| 2026-04-16T17:00:47.6600115-07:00 | background | PowerShell 4104 | scriptblock | on.GeneratedTypes.MpPreference.UpdatesChannelType'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__... | on.GeneratedTypes.MpPreference.UpdatesChannelType'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_method... |
| 2026-04-16T17:00:47.6600049-07:00 | background | PowerShell 4104 | scriptblock | 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletiza... | 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter... |
| 2026-04-16T17:00:47.6599983-07:00 | background | PowerShell 4104 | scriptblock | rameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletizati... | rameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.... |
| 2026-04-16T17:00:47.6599916-07:00 | background | PowerShell 4104 | scriptblock | [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisableScanningMappedNetworkDrivesForFullScan')) { ... | [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisableScanningMappedNetworkDrivesForFullScan')) { [object]$__cmd... |
| 2026-04-16T17:00:47.6599849-07:00 | background | PowerShell 4104 | scriptblock | arameter]@{Name = 'RandomizeScheduleTaskTimes'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} ... | arameter]@{Name = 'RandomizeScheduleTaskTimes'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { ... |
| 2026-04-16T17:00:47.6599774-07:00 | background | PowerShell 4104 | scriptblock | n_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('SignatureUpdateInterval'... | n_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('SignatureUpdateInterval')) { [obj... |
| 2026-04-16T17:00:47.6599709-07:00 | background | PowerShell 4104 | scriptblock | 'ScanScheduleQuickScanTime'; ParameterType = 'System.DateTime'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_def... | 'ScanScheduleQuickScanTime'; ParameterType = 'System.DateTime'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} ... |
| 2026-04-16T17:00:47.6599639-07:00 | background | PowerShell 4104 | scriptblock | Cmdletization.MethodParameter]@{Name = 'BruteForceProtectionSkipLearningPeriod'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_... | Cmdletization.MethodParameter]@{Name = 'BruteForceProtectionSkipLearningPeriod'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresen... |
| 2026-04-16T17:00:47.6599553-07:00 | background | PowerShell 4104 | scriptblock | [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('R... | [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('RemediationScheduleDa... |
| 2026-04-16T17:00:47.6599474-07:00 | background | PowerShell 4104 | scriptblock | [bool] ${EnableDnsSinkhole}, [Parameter(ParameterSetName='Set0')] [Alias('dicf')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] ... | [bool] ${EnableDnsSinkhole}, [Parameter(ParameterSetName='Set0')] [Alias('dicf')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${Di... |
| 2026-04-16T17:00:47.6599390-07:00 | background | PowerShell 4104 | scriptblock | ation.GeneratedTypes.MpPreference.MAPSReportingType] ${MAPSReporting}, [Parameter(ParameterSetName='Set0')] [ValidateNotNull()] [Valida... | ation.GeneratedTypes.MpPreference.MAPSReportingType] ${MAPSReporting}, [Parameter(ParameterSetName='Set0')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] ... |
| 2026-04-16T17:00:47.6599307-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T17:00:47.4838839-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T17:00:47.3833529-07:00 | background | PowerShell 4104 | scriptblock | +wRAgZfYPq2eAYYEjIwMjAwOTIyMjIxOTUwLjkzWjAEgAIB9KCB1KSB0TCBzjEL # MAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1v # bmQxHjAcBgNVBAoTFU1pY3... | +wRAgZfYPq2eAYYEjIwMjAwOTIyMjIxOTUwLjkzWjAEgAIB9KCB1KSB0TCBzjEL # MAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1v # bmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdG... |
| 2026-04-16T17:00:47.3833442-07:00 | background | PowerShell 4104 | scriptblock | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author = 'Microsoft ... |
| 2026-04-16T17:00:47.2292631-07:00 | background | PowerShell 4104 | scriptblock | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file exc... |
| 2026-04-16T17:00:46.8992624-07:00 | background | PowerShell 4104 | scriptblock | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } |
| 2026-04-16T17:00:46.8844235-07:00 | background | PowerShell 4104 | scriptblock | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } |
| 2026-04-16T17:00:46.8655707-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T17:00:46.5973326-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T17:00:46.4124099-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.4124065-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.4124053-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.4124039-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.4124026-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.4124010-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.4123972-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.4123959-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.4123947-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.4123931-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.4123891-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.4123868-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T17:00:46.3715472-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0... |
| 2026-04-16T17:00:46.2312159-07:00 | background | PowerShell 4104 | scriptblock | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { $_.DisplayName -matc... |
| 2026-04-16T17:00:46.0887273-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_Op... |
| 2026-04-16T17:00:45.9769673-07:00 | background | Security 4688 | process | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --outdir .\reports |
| 2026-04-16T16:57:36.5034759-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:57:36.4960389-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe92_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe92_ Global\UsGthrCtrlFltPipeMssGthrPipe92 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T16:57:35.5030225-07:00 | background | Security 4688 | process | StoreDesktopExtension.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" ... | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" -Embedding |
| 2026-04-16T16:56:07.0709522-07:00 | background | Security 4688 | process | Taskmgr.exe <= Taskmgr.exe | "C:\windows\system32\taskmgr.exe" /4 | "C:\windows\system32\taskmgr.exe" /4 |
| 2026-04-16T16:56:07.0034184-07:00 | background | Security 4688 | process | consent.exe <= svchost.exe | consent.exe 4976 452 0000025EA21BF430 | consent.exe 4976 452 0000025EA21BF430 |
| 2026-04-16T16:55:15.2638226-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T16:55:10.2046070-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T16:55:01.8076460-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:55:01.3312298-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe91_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe91_ Global\UsGthrCtrlFltPipeMssGthrPipe91 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T16:54:58.0755591-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:54:57.9054463-07:00 | background | Security 4688 | process | CHXSmartScreen.exe <= svchost.exe | "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe" -ServerName:App.AppXk7vvv12h4qrk... | "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe" -ServerName:App.AppXk7vvv12h4qrkhkbvf6j86ja45mzj5km9.mca |
| 2026-04-16T16:54:55.9663760-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T16:54:53.2541699-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T16:54:53.1794070-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T16:54:53.0681030-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T16:54:52.9933063-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T16:54:52.8392805-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyC... |
| 2026-04-16T16:54:52.6957228-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Oper... |
| 2026-04-16T16:54:52.6802533-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T16:54:52.5992550-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T16:54:52.4244479-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T16:54:52.2592652-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... |
| 2026-04-16T16:54:52.1214795-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $... |
| 2026-04-16T16:54:52.0751366-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T16:54:50.1586142-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T16:54:50.0903319-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T16:54:49.9144209-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T16:54:49.7615815-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction Silen... |
| 2026-04-16T16:54:49.6191155-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/... |
| 2026-04-16T16:54:49.6038144-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T16:54:49.5216086-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T16:54:49.3701452-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T16:54:49.2114975-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... |
| 2026-04-16T16:54:49.0714172-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Def... |
| 2026-04-16T16:54:49.0553159-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T16:54:48.8751081-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T16:54:48.7733625-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T16:54:48.5972664-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T16:54:48.4324234-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObject]... |
| 2026-04-16T16:54:48.2966356-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).A... |
| 2026-04-16T16:54:48.2721138-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T16:54:43.1474309-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T16:54:43.0764929-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T16:54:42.8998156-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T16:54:42.7483318-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObjec... |
| 2026-04-16T16:54:42.6058768-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date)... |
| 2026-04-16T16:54:42.5863008-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T16:54:42.3982714-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T16:54:42.3858188-07:00 | background | PowerShell 4104 | scriptblock | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... |
| 2026-04-16T16:54:42.3742620-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T16:54:42.2821027-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T16:54:42.1921319-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T16:54:42.1439848-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T16:54:42.0620634-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T16:54:41.9792497-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T16:54:41.9107061-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T16:54:41.8415764-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T16:54:41.7822157-07:00 | background | PowerShell 4104 | scriptblock | _methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSB... | _methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.Conta... |
| 2026-04-16T16:54:41.7822099-07:00 | background | PowerShell 4104 | scriptblock | cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AllowNetworkProtectionDownLevel'; ParameterType = 'System.Manag... | cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AllowNetworkProtectionDownLevel'; ParameterType = 'System.Management.Automation.Swi... |
| 2026-04-16T16:54:41.7821993-07:00 | background | PowerShell 4104 | scriptblock | n_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defa... | n_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null ... |
| 2026-04-16T16:54:41.7821899-07:00 | background | PowerShell 4104 | scriptblock | rkScanningToIOAV} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ApplyDisableNetworkScanningToIO... | rkScanningToIOAV} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ApplyDisableNetworkScanningToIOAV'; ParameterType =... |
| 2026-04-16T16:54:41.7821807-07:00 | background | PowerShell 4104 | scriptblock | zation_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_meth... | zation_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) ... |
| 2026-04-16T16:54:41.7821715-07:00 | background | PowerShell 4104 | scriptblock | $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureFirstAuGracePeriod'; ParameterType = 'System.Manage... | $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureFirstAuGracePeriod'; ParameterType = 'System.Management.Automation.Swit... |
| 2026-04-16T16:54:41.7821625-07:00 | background | PowerShell 4104 | scriptblock | Aggressiveness} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'BruteForceProtectionAggressivenes... | Aggressiveness} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'BruteForceProtectionAggressiveness'; ParameterType = ... |
| 2026-04-16T16:54:41.7821535-07:00 | background | PowerShell 4104 | scriptblock | {DisableQuicParsing}, [Parameter(ParameterSetName='Remove2')] [Alias('nprepmode')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] ... | {DisableQuicParsing}, [Parameter(ParameterSetName='Remove2')] [Alias('nprepmode')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${Netw... |
| 2026-04-16T16:54:41.7821422-07:00 | background | PowerShell 4104 | scriptblock | ${BruteForceProtectionExclusions}, [Parameter(ParameterSetName='Remove2')] [Alias('bfplnb')] [ValidateNotNull()] [ValidateNotNullOrEmpt... | ${BruteForceProtectionExclusions}, [Parameter(ParameterSetName='Remove2')] [Alias('bfplnb')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ... |
| 2026-04-16T16:54:41.7821331-07:00 | background | PowerShell 4104 | scriptblock | Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.M... | Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Nam... |
| 2026-04-16T16:54:41.7821240-07:00 | background | PowerShell 4104 | scriptblock | true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'EnableUdpSegmentationOffl... | true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'EnableUdpSegmentationOffload'; ParameterType ... |
| 2026-04-16T16:54:41.7821123-07:00 | background | PowerShell 4104 | scriptblock | $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableSshParsing'; ParameterType = 'System.Boolean'; Bindin... | $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableSshParsing'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $... |
| 2026-04-16T16:54:41.7821033-07:00 | background | PowerShell 4104 | scriptblock | r) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.... | r) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('EnableN... |
| 2026-04-16T16:54:41.7820709-07:00 | background | PowerShell 4104 | scriptblock | me = 'DisableEmailScanning'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { ... | me = 'DisableEmailScanning'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletiza... |
| 2026-04-16T16:54:41.7820618-07:00 | background | PowerShell 4104 | scriptblock | rs.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $... | rs.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($... |
| 2026-04-16T16:54:41.7820523-07:00 | background | PowerShell 4104 | scriptblock | ay'; ParameterType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} ... | ay'; ParameterType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmd... |
| 2026-04-16T16:54:41.7820426-07:00 | background | PowerShell 4104 | scriptblock | etization.MethodParameter]@{Name = 'RemediationScheduleTime'; ParameterType = 'System.DateTime'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePres... | etization.MethodParameter]@{Name = 'RemediationScheduleTime'; ParameterType = 'System.DateTime'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} ... |
| 2026-04-16T16:54:41.7819983-07:00 | background | PowerShell 4104 | scriptblock | dletization.GeneratedTypes.MpPreference.ASRRuleActionType] ${EnableNetworkProtection}, [Parameter(ParameterSetName='Set0')] [ValidateNotNull... | dletization.GeneratedTypes.MpPreference.ASRRuleActionType] ${EnableNetworkProtection}, [Parameter(ParameterSetName='Set0')] [ValidateNotNull()] [ValidateNo... |
| 2026-04-16T16:54:41.7819845-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T16:54:41.5949681-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T16:54:41.4991211-07:00 | background | PowerShell 4104 | scriptblock | RUQwzXTbg4CLNC3ZOs1nMwVyaCo0UN0Or1R4HNvyRgMlhgRvJYR4YyhB50 # YWeRX4FUsc+TTJLBxKZd0WETbijGGvmGgLvfYfxGwScdJGcSchohiq9LZIlQYrFd # /XcfPfBXday9ikJNQFHRD5wGPmd... | RUQwzXTbg4CLNC3ZOs1nMwVyaCo0UN0Or1R4HNvyRgMlhgRvJYR4YyhB50 # YWeRX4FUsc+TTJLBxKZd0WETbijGGvmGgLvfYfxGwScdJGcSchohiq9LZIlQYrFd # /XcfPfBXday9ikJNQFHRD5wGPmd/9WbAA5ZEfu/QS/1u5Zr... |
| 2026-04-16T16:54:41.4991126-07:00 | background | PowerShell 4104 | scriptblock | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author = 'Microsoft ... |
| 2026-04-16T16:54:41.3474801-07:00 | background | PowerShell 4104 | scriptblock | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file exc... |
| 2026-04-16T16:54:41.0348135-07:00 | background | PowerShell 4104 | scriptblock | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } |
| 2026-04-16T16:54:41.0193913-07:00 | background | PowerShell 4104 | scriptblock | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } |
| 2026-04-16T16:54:40.9993538-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T16:54:40.7148542-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T16:54:40.5317423-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.5317410-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.5317397-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.5317362-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.5317349-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.5317336-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.5317323-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.5317309-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.5317275-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.5317262-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.5317247-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.5317224-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T16:54:40.4886580-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0... |
| 2026-04-16T16:54:40.3497115-07:00 | background | PowerShell 4104 | scriptblock | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { $_.DisplayName -matc... |
| 2026-04-16T16:54:40.2022995-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_Op... |
| 2026-04-16T16:54:40.0869812-07:00 | background | Security 4688 | process | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --outdir .\reports |
| 2026-04-16T16:54:01.5980532-07:00 | background | Security 4688 | process | Taskmgr.exe <= Taskmgr.exe | "C:\windows\system32\taskmgr.exe" /4 | "C:\windows\system32\taskmgr.exe" /4 |
| 2026-04-16T16:54:01.5239378-07:00 | background | Security 4688 | process | consent.exe <= svchost.exe | consent.exe 4976 452 0000025EA21CB810 | consent.exe 4976 452 0000025EA21CB810 |
| 2026-04-16T16:52:59.4563707-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:52:27.9838169-07:00 | background | Security 4688 | process | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | C:\Windows\System32\smartscreen.exe -Embedding |
| 2026-04-16T16:52:25.4748268-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US -... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-captu... |
| 2026-04-16T16:52:25.4748230-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US -... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-captu... |
| 2026-04-16T16:52:25.3599541-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T16:52:21.2985698-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T16:52:19.5059952-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T16:51:50.0290513-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:51:24.1595754-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} |
| 2026-04-16T16:51:24.1228950-07:00 | background | Security 4688 | process | rundll32.exe <= svchost.exe | "C:\windows\system32\rundll32.exe" "C:\windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsNotepad_8wekyb3d8bbwe | "C:\windows\system32\rundll32.exe" "C:\windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsNotepad_8wekyb3d8bbwe |
| 2026-04-16T16:51:24.1042581-07:00 | background | Security 4688 | process | rundll32.exe <= svchost.exe | C:\windows\system32\rundll32.exe C:\windows\system32\AppXDeploymentExtensions.OneCore.dll,ShellRefresh | C:\windows\system32\rundll32.exe C:\windows\system32\AppXDeploymentExtensions.OneCore.dll,ShellRefresh |
| 2026-04-16T16:50:18.6483383-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:50:12.0626749-07:00 | background | Security 4688 | process | taskhostw.exe <= svchost.exe | taskhostw.exe | taskhostw.exe |
| 2026-04-16T16:50:01.4899535-07:00 | background | Security 4688 | process | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" |
| 2026-04-16T16:49:52.7831648-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} |
| 2026-04-16T16:49:52.7459783-07:00 | background | Security 4688 | process | rundll32.exe <= svchost.exe | "C:\windows\system32\rundll32.exe" "C:\windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsNotepad_8wekyb3d8bbwe | "C:\windows\system32\rundll32.exe" "C:\windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsNotepad_8wekyb3d8bbwe |
| 2026-04-16T16:49:52.7205886-07:00 | background | Security 4688 | process | rundll32.exe <= svchost.exe | C:\windows\system32\rundll32.exe C:\windows\system32\AppXDeploymentExtensions.OneCore.dll,ShellRefresh | C:\windows\system32\rundll32.exe C:\windows\system32\AppXDeploymentExtensions.OneCore.dll,ShellRefresh |
| 2026-04-16T16:49:38.2502547-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:49:31.6462221-07:00 | background | Security 4688 | process | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" |
| 2026-04-16T16:49:29.0411201-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:49:27.9486348-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXe9cvj1thv1hmcw0cs98xm3r97tyzy2xs.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXe9cvj1thv1hmcw0cs98xm3r97tyzy2xs.mca |
| 2026-04-16T16:49:23.7137088-07:00 | background | Security 4688 | process | wermgr.exe <= svchost.exe | "C:\windows\system32\wermgr.exe" -upload | "C:\windows\system32\wermgr.exe" -upload |
| 2026-04-16T16:48:58.8531879-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe90_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe90_ Global\UsGthrCtrlFltPipeMssGthrPipe90 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T16:48:58.0020803-07:00 | background | Security 4688 | process | Notepad.exe <= sihost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" RestartByRestartManag... | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" RestartByRestartManager:* |
| 2026-04-16T16:48:57.4441623-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} |
| 2026-04-16T16:48:57.3962487-07:00 | background | Security 4688 | process | rundll32.exe <= svchost.exe | "C:\windows\system32\rundll32.exe" "C:\windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsNotepad_8wekyb3d8bbwe | "C:\windows\system32\rundll32.exe" "C:\windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsNotepad_8wekyb3d8bbwe |
| 2026-04-16T16:48:57.2789032-07:00 | background | Security 4688 | process | rundll32.exe <= svchost.exe | C:\windows\system32\rundll32.exe C:\windows\system32\AppXDeploymentExtensions.OneCore.dll,ShellRefresh | C:\windows\system32\rundll32.exe C:\windows\system32\AppXDeploymentExtensions.OneCore.dll,ShellRefresh |
| 2026-04-16T16:48:33.9265091-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T16:48:11.5822957-07:00 | background | Security 4688 | process | WerFault.exe <= svchost.exe | werfault.exe /hc /shared Global\2676ec20dd6649989e9f9e8ab22fc014 /t 0 /p 30504 | werfault.exe /hc /shared Global\2676ec20dd6649989e9f9e8ab22fc014 /t 0 /p 30504 |
| 2026-04-16T16:48:11.5508854-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k WerSvcGroup | C:\windows\System32\svchost.exe -k WerSvcGroup |
| 2026-04-16T16:48:11.5487781-07:00 | background | Security 4688 | process | dllhost.exe <= dllhost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} |
| 2026-04-16T16:47:40.4989739-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC |
| 2026-04-16T16:46:41.1769852-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:46:40.1829265-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T16:46:38.9961437-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F} | C:\windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F} |
| 2026-04-16T16:46:38.9708774-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} | C:\windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251} |
| 2026-04-16T16:46:38.5131026-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:46:38.4431093-07:00 | background | Security 4688 | process | WWAHost.exe <= svchost.exe | "C:\WINDOWS\system32\wwahost.exe" -ServerName:App.wwa | "C:\WINDOWS\system32\wwahost.exe" -ServerName:App.wwa |
| 2026-04-16T16:46:20.2659746-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T16:45:58.8621757-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T16:45:53.7492851-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T16:45:51.2021201-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --vid... |
| 2026-04-16T16:45:51.1088792-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --vid... |
| 2026-04-16T16:45:48.7206976-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T16:45:48.6343898-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T16:45:21.0059366-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k LocalService -p -s WebClient | C:\windows\system32\svchost.exe -k LocalService -p -s WebClient |
| 2026-04-16T16:45:12.9453684-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost | C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost |
| 2026-04-16T16:45:11.9664639-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T16:45:11.2924487-07:00 | background | Security 4688 | process | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | C:\Windows\System32\smartscreen.exe -Embedding |
| 2026-04-16T16:45:07.0987581-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:45:04.8231163-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T16:44:35.1038280-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:44:35.0627885-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T16:44:22.6746850-07:00 | background | Security 4688 | process | MicrosoftEdgeUpdate.exe <= svchost.exe | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler |
| 2026-04-16T16:42:42.8781321-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:42:42.7441483-07:00 | background | Security 4688 | process | StoreDesktopExtension.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" ... | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" -Embedding |
| 2026-04-16T16:42:42.6710300-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gj... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gjh2mj.mca |
| 2026-04-16T16:42:42.6637260-07:00 | background | Security 4688 | process | StoreDesktopExtension.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" ... | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" -Embedding |
| 2026-04-16T16:42:42.6413065-07:00 | background | Security 4688 | process | Zoom.exe <= svchost.exe | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule |
| 2026-04-16T16:42:27.3615257-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:42:27.3195331-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T16:42:27.1998728-07:00 | background | Security 4688 | process | taskhostw.exe <= svchost.exe | taskhostw.exe | taskhostw.exe |
| 2026-04-16T16:41:13.7319778-07:00 | background | Security 4688 | process | AccountsControlHost.exe <= svchost.exe | "C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe" -ServerName:App.AppX20qnn98v... | "C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe" -ServerName:App.AppX20qnn98vxw5bhxrjtb1f6rggecb2k15a.mca |
| 2026-04-16T16:39:07.8569895-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T16:39:07.8185586-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:39:05.6530114-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca |
| 2026-04-16T16:38:40.2846011-07:00 | background | Security 4688 | process | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False |
| 2026-04-16T16:38:30.7147828-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:38:30.6740076-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T16:38:30.6187079-07:00 | background | Security 4688 | process | BackgroundTransferHost.exe <= svchost.exe | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 |
| 2026-04-16T16:38:30.5290370-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T16:38:30.5175234-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC |
| 2026-04-16T16:38:30.5122605-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:38:30.4863445-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T16:38:30.4840779-07:00 | background | Security 4688 | process | SDXHelper.exe <= svchost.exe | "C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding | "C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding |
| 2026-04-16T16:38:30.4369556-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca |
| 2026-04-16T16:38:30.4218888-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca |
| 2026-04-16T16:38:30.3924024-07:00 | background | Security 4688 | process | SDXHelper.exe <= svchost.exe | "C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe" /onlogon | "C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe" /onlogon |
| 2026-04-16T16:38:30.3812804-07:00 | background | Security 4688 | process | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces |
| 2026-04-16T16:38:30.3450379-07:00 | background | Security 4688 | process | UsoClient.exe <= svchost.exe | "C:\windows\system32\usoclient.exe" StartWork | "C:\windows\system32\usoclient.exe" StartWork |
| 2026-04-16T16:35:10.3197341-07:00 | background | Security 4688 | process | ProcInfo.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provide... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\ProcInfo\ProcInfo.exe" --time "C:\windows\SystemTemp\c7ec7d1... |
| 2026-04-16T16:34:32.1892039-07:00 | background | Security 4688 | process | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" |
| 2026-04-16T16:33:33.8646263-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T16:32:48.0379780-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T16:32:44.3194144-07:00 | background | Security 4688 | process | conhost.exe <= sdbinst.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T16:32:44.3080737-07:00 | background | Security 4688 | process | sdbinst.exe <= svchost.exe | C:\windows\System32\sdbinst.exe -m -bg | C:\windows\System32\sdbinst.exe -m -bg |
| 2026-04-16T16:32:42.8313815-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T16:32:20.0584168-07:00 | background | Security 4688 | process | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\App... | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\AppData\Local\Temp\0a1ef42a-504b-4153-8ea3-fe098efa15... |
| 2026-04-16T16:32:06.3740466-07:00 | background | Security 4688 | process | DataExchangeHost.exe <= svchost.exe | C:\Windows\System32\DataExchangeHost.exe -Embedding | C:\Windows\System32\DataExchangeHost.exe -Embedding |
| 2026-04-16T16:31:59.9616151-07:00 | background | Security 4688 | process | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\App... | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\AppData\Local\Temp\0c616458-685c-4307-9b53-dfc4d863f0... |
| 2026-04-16T16:31:42.9458745-07:00 | background | Security 4688 | process | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --la... | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user... |
| 2026-04-16T16:31:42.9426030-07:00 | background | Security 4688 | process | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\labuser\AppData\Roaming\... | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\labuser\AppData\Roaming\Code" --gpu-preferences=SAAAAAAAAADgAAAEAAA... |
| 2026-04-16T16:31:42.9031071-07:00 | background | Security 4688 | process | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\labuser\AppData\Roam... | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\labuser\AppData\Roaming\Code /prefetch:4 --no-rate-limit --moni... |
| 2026-04-16T16:31:42.7398976-07:00 | background | Security 4688 | process | Code.exe <= explorer.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\labuser\AppData\Local\Temp\1f836303-d3a9-4e23-9317-eb14... | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\labuser\AppData\Local\Temp\1f836303-d3a9-4e23-9317-eb14bd338e4d_windows-ir-lab-github-preview.zip.e4d\... |
| 2026-04-16T16:30:58.8624927-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T16:30:53.2810310-07:00 | background | Security 4688 | process | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --la... | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user... |
| 2026-04-16T16:30:53.2773053-07:00 | background | Security 4688 | process | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\labuser\AppData\Roaming\... | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\labuser\AppData\Roaming\Code" --gpu-preferences=SAAAAAAAAADgAAAEAAA... |
| 2026-04-16T16:30:53.2348280-07:00 | background | Security 4688 | process | Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\labuser\AppData\Roam... | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\labuser\AppData\Roaming\Code /prefetch:4 --no-rate-limit --moni... |
| 2026-04-16T16:30:53.0685406-07:00 | background | Security 4688 | process | Code.exe <= explorer.exe | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\labuser\Downloads\GITHUB_PREVIEW.md" | "C:\Users\labuser\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\labuser\Downloads\GITHUB_PREVIEW.md" |
| 2026-04-16T16:30:53.0294060-07:00 | background | Security 4688 | process | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | C:\Windows\System32\smartscreen.exe -Embedding |
| 2026-04-16T16:30:48.6119803-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:30:31.6871292-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:30:30.9900811-07:00 | background | Security 4688 | process | SearchFilterHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchFilterHost.exe" 932 3788 3824 916 {5E941D80-BF96-11CD-B579-08002B30BFEB} | "C:\windows\System32\SearchFilterHost.exe" 932 3788 3824 916 {5E941D80-BF96-11CD-B579-08002B30BFEB} |
| 2026-04-16T16:30:30.5265825-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T16:30:30.5108564-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T16:30:30.4923131-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T16:30:30.4717360-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T16:30:27.4274357-07:00 | background | Security 4688 | process | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T16:30:27.4181979-07:00 | background | Security 4688 | process | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\_Shared\DiskCheck\ETD_GetSMART.exe" |
| 2026-04-16T16:30:23.1833828-07:00 | background | Security 4688 | process | SearchFilterHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchFilterHost.exe" 932 3248 3932 916 {3B224B11-9363-407E-850F-C9E1FFACD8FB} | "C:\windows\System32\SearchFilterHost.exe" 932 3248 3932 916 {3B224B11-9363-407E-850F-C9E1FFACD8FB} |
| 2026-04-16T16:30:23.1466650-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe89_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe89_ Global\UsGthrCtrlFltPipeMssGthrPipe89 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T16:30:23.0617351-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T16:30:22.8046988-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T16:30:22.3228558-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-U... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --video-captur... |
| 2026-04-16T16:29:18.2705075-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T16:29:18.2344647-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:29:16.0610917-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca |
| 2026-04-16T16:28:27.4114025-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:28:27.3714270-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T16:28:27.2499555-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T16:28:27.2245575-07:00 | background | Security 4688 | process | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False |
| 2026-04-16T16:28:27.1306730-07:00 | background | Security 4688 | process | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces |
| 2026-04-16T16:24:00.4018472-07:00 | background | Security 4688 | process | taskhostw.exe <= svchost.exe | taskhostw.exe -flow showtoast -checkup recoverability | taskhostw.exe -flow showtoast -checkup recoverability |
| 2026-04-16T16:23:40.0016595-07:00 | background | Security 4688 | process | SecurityHealthHost.exe <= svchost.exe | \\?\C:\Windows\System32\SecurityHealth\10.0.29554.1001-0\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A... | \\?\C:\Windows\System32\SecurityHealth\10.0.29554.1001-0\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding |
| 2026-04-16T16:23:30.0564523-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:23:30.0102167-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T16:23:30.0088299-07:00 | background | Security 4688 | process | taskhostw.exe <= svchost.exe | taskhostw.exe | taskhostw.exe |
| 2026-04-16T16:23:29.9258947-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T16:23:29.9253807-07:00 | background | Security 4688 | process | HPSystemEventUtilityHost.exe <= HPSystemEventUtilityBackground.exe | "C:\Program Files\WindowsApps\AD2F1837.HPSystemEventUtility_3.2.16.0_x64__v10z8vjag6ke6\... | "C:\Program Files\WindowsApps\AD2F1837.HPSystemEventUtility_3.2.16.0_x64__v10z8vjag6ke6\SystemEventUtility\HPSystemEventUtilityHost.exe" |
| 2026-04-16T16:23:29.9108358-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k CameraMonitor | C:\windows\System32\svchost.exe -k CameraMonitor |
| 2026-04-16T16:23:29.8926218-07:00 | background | Security 4688 | process | taskhostw.exe <= svchost.exe | taskhostw.exe KEYROAMING | taskhostw.exe KEYROAMING |
| 2026-04-16T16:23:23.9080730-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T16:23:23.8692927-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T16:23:21.7455965-07:00 | background | Security 4688 | process | ctfmon.exe <= svchost.exe | /QuitInfo:00000000000003B4;00000000000003F0; | /QuitInfo:00000000000003B4;00000000000003F0; |
| 2026-04-16T16:23:21.6935919-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca |
| 2026-04-16T16:20:32.2326481-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T16:20:31.8862740-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T16:20:31.8556832-07:00 | background | Security 4688 | process | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update |
| 2026-04-16T16:20:31.8009538-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T16:20:31.7704820-07:00 | background | Security 4688 | process | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal |
| 2026-04-16T16:20:31.7213147-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T16:20:31.6838692-07:00 | background | Security 4688 | process | updater.exe <= svchost.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system |
| 2026-04-16T16:20:01.8781306-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T16:20:01.8463303-07:00 | background | Security 4688 | process | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update |
| 2026-04-16T16:19:52.0074613-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T16:19:51.9773921-07:00 | background | Security 4688 | process | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal |
| 2026-04-16T16:19:51.9354332-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T16:19:51.8999576-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system |
| 2026-04-16T16:19:51.8660853-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T16:19:51.8272970-07:00 | background | Security 4688 | process | updater.exe <= chrome.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake-all --system | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake-all --system |
| 2026-04-16T16:19:51.7639641-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T16:19:51.7314168-07:00 | background | Security 4688 | process | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update |
| 2026-04-16T16:19:45.5665592-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gp... |
| 2026-04-16T16:19:45.5396226-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=patch.mojom.FilePatcher --lang=en-US --s... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=patch.mojom.FilePatcher --lang=en-US --service-sandbox-type=service --video-capture-use... |
| 2026-04-16T16:19:45.5210532-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gp... |
| 2026-04-16T16:19:33.2437302-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k netsvcs -p -s BITS | C:\windows\System32\svchost.exe -k netsvcs -p -s BITS |
| 2026-04-16T16:18:33.8033104-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T16:18:02.8850487-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T16:15:58.9030302-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T16:15:58.8969041-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T16:10:47.8808061-07:00 | background | Security 4688 | process | vulnerability.scan.exe <= bdservicehost.exe | --hosts-verifier --start --proxy= --proxy-authentication= | --hosts-verifier --start --proxy= --proxy-authentication= |
| 2026-04-16T16:03:33.7485670-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T16:00:58.8536619-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T15:59:04.9057498-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k defragsvc | C:\windows\system32\svchost.exe -k defragsvc |
| 2026-04-16T15:59:04.8872308-07:00 | background | Security 4688 | process | conhost.exe <= Defrag.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:59:04.8812373-07:00 | background | Security 4688 | process | Defrag.exe <= svchost.exe | "C:\windows\system32\defrag.exe" -p 11f0 -s 0000000000000474 -b -OnlyPreferred C: | "C:\windows\system32\defrag.exe" -p 11f0 -s 0000000000000474 -b -OnlyPreferred C: |
| 2026-04-16T15:59:04.5436279-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T15:59:04.4987511-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T15:59:04.3653796-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T15:59:04.3161367-07:00 | background | Security 4688 | process | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False |
| 2026-04-16T15:59:04.2232462-07:00 | background | Security 4688 | process | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces |
| 2026-04-16T15:55:01.0947064-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca |
| 2026-04-16T15:55:00.9451087-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T15:55:00.7817637-07:00 | background | Security 4688 | process | LockApp.exe <= svchost.exe | "C:\windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe" -ServerName:WindowsDefaultLockScreen.AppX7y4nbzq37zn4ks9k7am... | "C:\windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe" -ServerName:WindowsDefaultLockScreen.AppX7y4nbzq37zn4ks9k7amqjywdat7d3j2z.mca |
| 2026-04-16T15:55:00.7272572-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k CameraMonitor | C:\windows\System32\svchost.exe -k CameraMonitor |
| 2026-04-16T15:55:00.7174699-07:00 | background | Security 4688 | process | taskhostw.exe <= svchost.exe | taskhostw.exe KEYROAMING | taskhostw.exe KEYROAMING |
| 2026-04-16T15:55:00.6607517-07:00 | background | Security 4688 | process | LogonUI.exe <= winlogon.exe | "LogonUI.exe" /flags:0x0 /state0:0xa08da855 /state1:0x41c64e6d | "LogonUI.exe" /flags:0x0 /state0:0xa08da855 /state1:0x41c64e6d |
| 2026-04-16T15:54:58.5059876-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T15:54:58.4602053-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T15:53:15.8903364-07:00 | background | Security 4688 | process | ProcInfo.exe <= TouchpointAnalyticsClient.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data ... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\ProcInfo\ProcInfo.exe" --winstoreapp "C:\ProgramData\HP\HP T... |
| 2026-04-16T15:52:58.4373534-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T15:52:37.0491337-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T15:52:33.7834310-07:00 | background | Security 4688 | process | conhost.exe <= w32tm.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:52:33.7710133-07:00 | background | Security 4688 | process | w32tm.exe <= TouchpointAnalyticsClient.exe | "C:\windows\system32\w32tm.exe" /query /status /verbose | "C:\windows\system32\w32tm.exe" /query /status /verbose |
| 2026-04-16T15:52:27.0949700-07:00 | background | Security 4688 | process | conhost.exe <= netsh.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:52:27.0860237-07:00 | background | Security 4688 | process | netsh.exe <= TouchpointAnalyticsClient.exe | "C:\windows\system32\netsh.exe" wlan show interfaces | "C:\windows\system32\netsh.exe" wlan show interfaces |
| 2026-04-16T15:52:16.3190649-07:00 | background | Security 4688 | process | powercfg.exe <= cmd.exe | powercfg /sleepstudy /output "C:\ProgramData\HP\HP Touchpoint Analytics Client\Provider Data\DeviceOnlineTime\Sleepxml.xml" /xml /... | powercfg /sleepstudy /output "C:\ProgramData\HP\HP Touchpoint Analytics Client\Provider Data\DeviceOnlineTime\Sleepxml.xml" /xml /duration 2" |
| 2026-04-16T15:52:16.3013747-07:00 | background | Security 4688 | process | conhost.exe <= cmd.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:52:16.2907765-07:00 | background | Security 4688 | process | cmd.exe <= TouchpointAnalyticsClient.exe | "C:\windows\system32\cmd.exe" "/C powercfg /sleepstudy /output "C:\ProgramData\HP\HP Touchpoint Analytics Client\P... | "C:\windows\system32\cmd.exe" "/C powercfg /sleepstudy /output "C:\ProgramData\HP\HP Touchpoint Analytics Client\Provider Data\DeviceOnlineTime\Sleepxml.xml" /xml /duration 2" |
| 2026-04-16T15:52:16.2182040-07:00 | background | Security 4688 | process | conhost.exe <= sigcheck.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:52:16.2082560-07:00 | background | Security 4688 | process | sigcheck.exe <= TouchpointAnalyticsClient.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data ... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\Sigcheck\sigcheck.exe" /nobanner /accepteula C:\windows\sys... |
| 2026-04-16T15:52:16.1210982-07:00 | background | Security 4688 | process | conhost.exe <= sigcheck.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:52:16.1059121-07:00 | background | Security 4688 | process | sigcheck.exe <= TouchpointAnalyticsClient.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data ... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\Sigcheck\sigcheck.exe" /nobanner /accepteula C:\windows\sys... |
| 2026-04-16T15:52:15.8005783-07:00 | background | Security 4688 | process | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:52:15.7894957-07:00 | background | Security 4688 | process | ETD_GetSMART.exe <= TouchpointAnalyticsClient.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider D... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\_Shared\DiskCheck\ETD_GetSMART.exe" |
| 2026-04-16T15:51:10.9667122-07:00 | background | Security 4688 | process | conhost.exe <= schtasks.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:51:10.9515104-07:00 | background | Security 4688 | process | schtasks.exe <= TouchpointAnalyticsClient.exe | "C:\windows\system32\schtasks.exe" /Change /TN "Hewlett-Packard\HP Active Health\HP Active Health Scan" /DISABLE | "C:\windows\system32\schtasks.exe" /Change /TN "Hewlett-Packard\HP Active Health\HP Active Health Scan" /DISABLE |
| 2026-04-16T15:49:09.6357116-07:00 | background | Security 4688 | process | TouchpointAnalyticsClient.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c1... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\TouchpointAnalyticsClient.exe" |
| 2026-04-16T15:48:33.6822336-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T15:45:58.8851110-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T15:45:58.8427676-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T15:45:58.8369491-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXpybpk6fj2fe0gb0jan49e6dncngk3pa1.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXpybpk6fj2fe0gb0jan49e6dncngk3pa1.mca |
| 2026-04-16T15:45:52.9505217-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T15:45:28.5175562-07:00 | background | Security 4688 | process | rundll32.exe <= svchost.exe | "C:\windows\system32\rundll32.exe" C:\windows\system32\PcaSvc.dll,PcaPatchSdbTask | "C:\windows\system32\rundll32.exe" C:\windows\system32\PcaSvc.dll,PcaPatchSdbTask |
| 2026-04-16T15:45:11.3823797-07:00 | background | Security 4688 | process | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:45:11.3715302-07:00 | background | Security 4688 | process | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\_Shared\DiskCheck\ETD_GetSMART.exe" |
| 2026-04-16T15:45:10.9290368-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T15:44:22.6751436-07:00 | background | Security 4688 | process | MicrosoftEdgeUpdate.exe <= svchost.exe | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler |
| 2026-04-16T15:44:11.9079297-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T15:43:56.7611424-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T15:42:42.6488422-07:00 | background | Security 4688 | process | Zoom.exe <= svchost.exe | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule |
| 2026-04-16T15:42:20.8698735-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T15:42:20.6774228-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T15:42:20.6619443-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca |
| 2026-04-16T15:42:20.6393847-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gj... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gjh2mj.mca |
| 2026-04-16T15:40:06.8012438-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T15:40:01.7170590-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T15:40:01.6954875-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self... |
| 2026-04-16T15:40:01.6819006-07:00 | background | Security 4688 | process | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR-20260416-153841-LAB-HOST\windows_ir_stakehol... |
| 2026-04-16T15:40:01.6502837-07:00 | background | Security 4688 | process | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | C:\Windows\System32\smartscreen.exe -Embedding |
| 2026-04-16T15:39:13.9503407-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T15:39:13.5009390-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe88_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe88_ Global\UsGthrCtrlFltPipeMssGthrPipe88 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T15:39:07.8651981-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:39:01.5638846-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:39:01.4958588-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:39:01.3412747-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:39:01.2038058-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -E... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyC... |
| 2026-04-16T15:39:01.0505911-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Oper... |
| 2026-04-16T15:39:01.0357662-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:39:00.9474009-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:39:00.8038004-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:39:00.6739654-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... |
| 2026-04-16T15:39:00.5375990-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $... |
| 2026-04-16T15:39:00.4967943-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:38:58.4877129-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:38:58.4122837-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:38:58.2404537-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:38:58.1336049-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logNam... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction Silen... |
| 2026-04-16T15:38:57.9793844-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/... |
| 2026-04-16T15:38:57.9646991-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:38:57.8824584-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:38:57.7146722-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:38:57.5670930-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... |
| 2026-04-16T15:38:57.4113847-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Def... |
| 2026-04-16T15:38:57.3961797-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:38:57.2014538-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:38:57.0976034-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:38:56.9180699-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:38:56.7692045-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObject]... |
| 2026-04-16T15:38:56.6291924-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).A... |
| 2026-04-16T15:38:56.5932185-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:38:44.0013351-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:38:43.9337764-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:38:43.7752844-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:38:43.6194931-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-7) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObjec... |
| 2026-04-16T15:38:43.4786521-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date)... |
| 2026-04-16T15:38:43.4594789-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:38:43.3060088-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T15:38:43.2948086-07:00 | background | PowerShell 4104 | scriptblock | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... |
| 2026-04-16T15:38:43.2835343-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:38:43.2211229-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:38:43.1332849-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:38:43.0752179-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:38:42.9933871-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:38:42.9077424-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:38:42.8607818-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:38:42.7908310-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:38:42.7126569-07:00 | background | PowerShell 4104 | scriptblock | _value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = ... | _value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSurfaceReduct... |
| 2026-04-16T15:38:42.7126489-07:00 | background | PowerShell 4104 | scriptblock | leDnsSinkhole')) { [object]$__cmdletization_value = ${EnableDnsSinkhole} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdle... | leDnsSinkhole')) { [object]$__cmdletization_value = ${EnableDnsSinkhole} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParam... |
| 2026-04-16T15:38:42.7126411-07:00 | background | PowerShell 4104 | scriptblock | ion_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ProxyServer'; ParameterType = 'System.Management.Automation.SwitchParamet... | ion_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ProxyServer'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'... |
| 2026-04-16T15:38:42.7126316-07:00 | background | PowerShell 4104 | scriptblock | ameters.ContainsKey('PUAProtection')) { [object]$__cmdletization_value = ${PUAProtection} $__cmdletization_methodParameter = [Microsoft... | ameters.ContainsKey('PUAProtection')) { [object]$__cmdletization_value = ${PUAProtection} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletiz... |
| 2026-04-16T15:38:42.7126234-07:00 | background | PowerShell 4104 | scriptblock | } } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null ... | } } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdlet... |
| 2026-04-16T15:38:42.7126149-07:00 | background | PowerShell 4104 | scriptblock | n.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = ... | n.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShel... |
| 2026-04-16T15:38:42.7126072-07:00 | background | PowerShell 4104 | scriptblock | ject]$__cmdletization_value = ${SignatureFallbackOrder} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{N... | ject]$__cmdletization_value = ${SignatureFallbackOrder} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureFall... |
| 2026-04-16T15:38:42.7125963-07:00 | background | PowerShell 4104 | scriptblock | ion_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($... | ion_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.Co... |
| 2026-04-16T15:38:42.7125872-07:00 | background | PowerShell 4104 | scriptblock | n_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionConfiguredState')) { [object]$__cmdletizat... | n_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionConfiguredState')) { [object]$__cmdletization_value = ${Remote... |
| 2026-04-16T15:38:42.7125767-07:00 | background | PowerShell 4104 | scriptblock | [Parameter(ParameterSetName='Remove2')] [Alias('dgr')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${DisableGradualRelea... | [Parameter(ParameterSetName='Remove2')] [Alias('dgr')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${DisableGradualRelease}, [Paramet... |
| 2026-04-16T15:38:42.7125680-07:00 | background | PowerShell 4104 | scriptblock | [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ScanPurgeItemsAfterDelay}, [Parameter(ParameterSetName='Remove2')] [Alia... | [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ScanPurgeItemsAfterDelay}, [Parameter(ParameterSetName='Remove2')] [Alias('soiie')] [Va... |
| 2026-04-16T15:38:42.7125569-07:00 | background | PowerShell 4104 | scriptblock | methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ControlledFolderAccessAllowedApplications'; ParameterType = 'System.String[]'... | methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ControlledFolderAccessAllowedApplications'; ParameterType = 'System.String[]'; Bindings = 'In'; V... |
| 2026-04-16T15:38:42.7125485-07:00 | background | PowerShell 4104 | scriptblock | bleCoreServiceECSIntegration'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_de... | bleCoreServiceECSIntegration'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent}... |
| 2026-04-16T15:38:42.7125376-07:00 | background | PowerShell 4104 | scriptblock | rs.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $... | rs.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($... |
| 2026-04-16T15:38:42.7125281-07:00 | background | PowerShell 4104 | scriptblock | aultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisableSshParsing')) { [object]$__cmdletization_value = ${DisableSshParsi... | aultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisableSshParsing')) { [object]$__cmdletization_value = ${DisableSshParsing} $__cm... |
| 2026-04-16T15:38:42.7125187-07:00 | background | PowerShell 4104 | scriptblock | em.String[]'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdleti... | em.String[]'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParamet... |
| 2026-04-16T15:38:42.7125102-07:00 | background | PowerShell 4104 | scriptblock | alue = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__c... | alue = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodP... |
| 2026-04-16T15:38:42.7124814-07:00 | background | PowerShell 4104 | scriptblock | ization.MethodParameter]@{Name = 'DisableIntrusionPreventionSystem'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_defaultValue... | ization.MethodParameter]@{Name = 'DisableIntrusionPreventionSystem'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $... |
| 2026-04-16T15:38:42.7124715-07:00 | background | PowerShell 4104 | scriptblock | ]@{Name = 'SignatureUpdateInterval'; ParameterType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletizati... | ]@{Name = 'SignatureUpdateInterval'; ParameterType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPre... |
| 2026-04-16T15:38:42.7124295-07:00 | background | PowerShell 4104 | scriptblock | Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodP... | Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmd... |
| 2026-04-16T15:38:42.7124191-07:00 | background | PowerShell 4104 | scriptblock | Value = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('BruteForceProtectionMaxBlockTime'... | Value = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('BruteForceProtectionMaxBlockTime')) { [obj... |
| 2026-04-16T15:38:42.7124099-07:00 | background | PowerShell 4104 | scriptblock | lassName, $script:ClassVersion, $script:ModuleVersion, $script:PrivateData) if ($__cmdletization_objectModelWrapper -is [System.Management... | lassName, $script:ClassVersion, $script:ModuleVersion, $script:PrivateData) if ($__cmdletization_objectModelWrapper -is [System.Management.Automation.IDynamic... |
| 2026-04-16T15:38:42.7124005-07:00 | background | PowerShell 4104 | scriptblock | [Parameter(ParameterSetName='Set0')] [Alias('demsc')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${DisableEmailScanning},... | [Parameter(ParameterSetName='Set0')] [Alias('demsc')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${DisableEmailScanning}, [Parameter(P... |
| 2026-04-16T15:38:42.7123855-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:38:42.5112243-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:38:42.4144677-07:00 | background | PowerShell 4104 | scriptblock | jAxMS0w # Ny0wOC5jcmwwYQYIKwYBBQUHAQEEVTBTMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3 # Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY0NvZFNpZ1BDQTIwMTFfMjAx # MS0wNy0wOC... | jAxMS0w # Ny0wOC5jcmwwYQYIKwYBBQUHAQEEVTBTMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3 # Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY0NvZFNpZ1BDQTIwMTFfMjAx # MS0wNy0wOC5jcnQwDAYDVR0TAQH/BA... |
| 2026-04-16T15:38:42.4144551-07:00 | background | PowerShell 4104 | scriptblock | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author = 'Microsoft ... |
| 2026-04-16T15:38:42.2495742-07:00 | background | PowerShell 4104 | scriptblock | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file exc... |
| 2026-04-16T15:38:41.9132615-07:00 | background | PowerShell 4104 | scriptblock | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } |
| 2026-04-16T15:38:41.8981122-07:00 | background | PowerShell 4104 | scriptblock | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } |
| 2026-04-16T15:38:41.8784416-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:38:41.6156590-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:38:41.4467307-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4467294-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4467282-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4467224-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4467170-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4467158-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4467145-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4467132-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4467098-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4467085-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4467070-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4467049-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:38:41.4025246-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0... |
| 2026-04-16T15:38:41.2531802-07:00 | background | PowerShell 4104 | scriptblock | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { $_.DisplayName -matc... |
| 2026-04-16T15:38:41.1177133-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_Op... |
| 2026-04-16T15:38:41.0058931-07:00 | background | Security 4688 | process | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 7 --max-events 2000 --ou... | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 7 --max-events 2000 --outdir .\reports |
| 2026-04-16T15:35:48.1110287-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:35:48.1024429-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzMxMiwiY29u... |
| 2026-04-16T15:35:09.4832630-07:00 | background | Security 4688 | process | ProcInfo.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provide... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\ProcInfo\ProcInfo.exe" --time "C:\windows\SystemTemp\3e61a7a... |
| 2026-04-16T15:33:33.6094139-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T15:32:44.1847145-07:00 | background | Security 4688 | process | conhost.exe <= sdbinst.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:32:44.1756506-07:00 | background | Security 4688 | process | sdbinst.exe <= svchost.exe | C:\windows\System32\sdbinst.exe -m -bg | C:\windows\System32\sdbinst.exe -m -bg |
| 2026-04-16T15:31:44.4576785-07:00 | background | Security 4688 | process | BackgroundTransferHost.exe <= svchost.exe | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 |
| 2026-04-16T15:31:44.3796905-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC |
| 2026-04-16T15:31:44.3730603-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T15:31:44.2978216-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca |
| 2026-04-16T15:31:21.2919838-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T15:31:05.0265815-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T15:30:58.8448038-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T15:30:48.1013204-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:30:48.0934552-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MjIwMCwiY29u... |
| 2026-04-16T15:30:05.3153373-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T15:28:42.2177841-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T15:28:37.1374859-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T15:28:37.1143360-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self... |
| 2026-04-16T15:28:37.1001856-07:00 | background | Security 4688 | process | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR-20260416-152750-LAB-HOST\windows_ir_stakehol... |
| 2026-04-16T15:28:37.0687997-07:00 | background | Security 4688 | process | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | C:\Windows\System32\smartscreen.exe -Embedding |
| 2026-04-16T15:28:11.8313638-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T15:28:06.1351668-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:28:03.3609563-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:28:03.2934563-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:28:03.1437757-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:28:02.9871961-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyC... |
| 2026-04-16T15:28:02.8448259-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Oper... |
| 2026-04-16T15:28:02.8304005-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:28:02.7465845-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:28:02.5679016-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:28:02.4023699-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... |
| 2026-04-16T15:28:02.2724326-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $... |
| 2026-04-16T15:28:02.2332472-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:28:00.2971108-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:28:00.2240215-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:28:00.0689998-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:27:59.9252721-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction Silen... |
| 2026-04-16T15:27:59.7764014-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/... |
| 2026-04-16T15:27:59.7616257-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:27:59.6777480-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:27:59.5041027-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:27:59.3492868-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... |
| 2026-04-16T15:27:59.2048675-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Def... |
| 2026-04-16T15:27:59.1890505-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:27:58.9941185-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:27:58.8924793-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:27:58.7137406-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:27:58.5510397-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObject]... |
| 2026-04-16T15:27:58.4179367-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).A... |
| 2026-04-16T15:27:58.3934395-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:27:53.2744853-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:27:53.2080560-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:27:53.0590413-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:27:52.9238317-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObjec... |
| 2026-04-16T15:27:52.7880344-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date)... |
| 2026-04-16T15:27:52.7696071-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:27:52.6385843-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T15:27:52.6271163-07:00 | background | PowerShell 4104 | scriptblock | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... |
| 2026-04-16T15:27:52.6147358-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:27:52.5520658-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:27:52.4923343-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:27:52.4334450-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:27:52.3509952-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:27:52.2718833-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:27:52.2175583-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:27:52.1485464-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:27:52.0862655-07:00 | background | PowerShell 4104 | scriptblock | tion.MethodParameter]@{Name = 'RemoveScanningThreadPoolCap'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdl... | tion.MethodParameter]@{Name = 'RemoveScanningThreadPoolCap'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultVal... |
| 2026-04-16T15:27:52.0862607-07:00 | background | PowerShell 4104 | scriptblock | zation_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if... | zation_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters... |
| 2026-04-16T15:27:52.0862529-07:00 | background | PowerShell 4104 | scriptblock | oft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableDnsOverTcpParsing'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = ... | oft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableDnsOverTcpParsing'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmd... |
| 2026-04-16T15:27:52.0862450-07:00 | background | PowerShell 4104 | scriptblock | plications'; ParameterType = 'System.String[]'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdl... | plications'; ParameterType = 'System.String[]'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodPara... |
| 2026-04-16T15:27:52.0862371-07:00 | background | PowerShell 4104 | scriptblock | rameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defau... | rameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} ... |
| 2026-04-16T15:27:52.0862286-07:00 | background | PowerShell 4104 | scriptblock | alueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisableBehaviorMonitoring')) { [object]$__cmdletization_value = ${DisableBehav... | alueIsPresent = $false if ($PSBoundParameters.ContainsKey('DisableBehaviorMonitoring')) { [object]$__cmdletization_value = ${DisableBehaviorMonitoring} ... |
| 2026-04-16T15:27:52.0862204-07:00 | background | PowerShell 4104 | scriptblock | .Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletizati... | .Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter =... |
| 2026-04-16T15:27:52.0862131-07:00 | background | PowerShell 4104 | scriptblock | ValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue ... | ValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [ob... |
| 2026-04-16T15:27:52.0862058-07:00 | background | PowerShell 4104 | scriptblock | alue; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'B... | alue; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'BruteForceProtectionC... |
| 2026-04-16T15:27:52.0861968-07:00 | background | PowerShell 4104 | scriptblock | ValidateNotNullOrEmpty()] [switch] ${RemoveScanningThreadPoolCap}, [Parameter(ParameterSetName='Remove2')] [Alias('dcsei')] [Valid... | ValidateNotNullOrEmpty()] [switch] ${RemoveScanningThreadPoolCap}, [Parameter(ParameterSetName='Remove2')] [Alias('dcsei')] [ValidateNotNull()] [... |
| 2026-04-16T15:27:52.0861872-07:00 | background | PowerShell 4104 | scriptblock | [Parameter(ParameterSetName='Remove2')] [Alias('ddtgp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${DisableDatagramPr... | [Parameter(ParameterSetName='Remove2')] [Alias('ddtgp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${DisableDatagramProcessing}, [P... |
| 2026-04-16T15:27:52.0861728-07:00 | background | PowerShell 4104 | scriptblock | _cmdletization_value = ${AttackSurfaceReductionRules_RuleSpecificExclusions_Id} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletiza... | _cmdletization_value = ${AttackSurfaceReductionRules_RuleSpecificExclusions_Id} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter... |
| 2026-04-16T15:27:52.0861651-07:00 | background | PowerShell 4104 | scriptblock | eneratedTypes.MpPreference.ThreatAction[]] ${ThreatIDDefaultAction_Actions}, [Parameter(ParameterSetName='Add1')] [ValidateNotNull()] [... | eneratedTypes.MpPreference.ThreatAction[]] ${ThreatIDDefaultAction_Actions}, [Parameter(ParameterSetName='Add1')] [ValidateNotNull()] [ValidateNotNullOrEmp... |
| 2026-04-16T15:27:52.0861574-07:00 | background | PowerShell 4104 | scriptblock | $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'NetworkProtectionReputationMode'; ParameterType = 'System.UI... | $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'NetworkProtectionReputationMode'; ParameterType = 'System.UInt32'; Bindings = 'I... |
| 2026-04-16T15:27:52.0861492-07:00 | background | PowerShell 4104 | scriptblock | esent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [objec... | esent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_d... |
| 2026-04-16T15:27:52.0861411-07:00 | background | PowerShell 4104 | scriptblock | es_Actions} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSurfaceReductionRules_Actions';... | es_Actions} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSurfaceReductionRules_Actions'; ParameterType = 'Mi... |
| 2026-04-16T15:27:52.0861333-07:00 | background | PowerShell 4104 | scriptblock | uePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [o... | uePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletizati... |
| 2026-04-16T15:27:52.0861042-07:00 | background | PowerShell 4104 | scriptblock | hell.Cmdletization.MethodParameter]@{Name = 'DisableRealtimeMonitoring'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_defaultV... | hell.Cmdletization.MethodParameter]@{Name = 'DisableRealtimeMonitoring'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent... |
| 2026-04-16T15:27:52.0860965-07:00 | background | PowerShell 4104 | scriptblock | n_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureBlobFileSharesSources'; ParameterType = 'System.String'; Bindings ... | n_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureBlobFileSharesSources'; ParameterType = 'System.String'; Bindings = 'In'; Value = $__c... |
| 2026-04-16T15:27:52.0860501-07:00 | background | PowerShell 4104 | scriptblock | $__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('ScanSched... | $__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('ScanScheduleQuickScanTime')) ... |
| 2026-04-16T15:27:52.0860405-07:00 | background | PowerShell 4104 | scriptblock | [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('B... | [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('BruteForceProtectionA... |
| 2026-04-16T15:27:52.0860305-07:00 | background | PowerShell 4104 | scriptblock | { __cmdletization_BindCommonParameters $__cmdletization_objectModelWrapper $PSBoundParameters $__cmdletization_objectModelWrapper.B... | { __cmdletization_BindCommonParameters $__cmdletization_objectModelWrapper $PSBoundParameters $__cmdletization_objectModelWrapper.BeginProcessing() ... |
| 2026-04-16T15:27:52.0860206-07:00 | background | PowerShell 4104 | scriptblock | ${DisableRemovableDriveScanning}, [Parameter(ParameterSetName='Set0')] [Alias('drp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] ... | ${DisableRemovableDriveScanning}, [Parameter(ParameterSetName='Set0')] [Alias('drp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${Dis... |
| 2026-04-16T15:27:52.0860054-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:27:51.8793640-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:27:51.7881170-07:00 | background | PowerShell 4104 | scriptblock | C/je3bpUpjtxpEyqUqtPc30wEg/rO9vmKmqKoLPT37svc2NV # BmGNl+85qO4fV/w7Cx7J0Bbqk19KcRNdjt6eKoTnTPHBHlVHQIHZpMxacbFOAkJr # qAVkYZdz7ikNXTxV+GRb36tC4ByMNxE2DF7vF... | C/je3bpUpjtxpEyqUqtPc30wEg/rO9vmKmqKoLPT37svc2NV # BmGNl+85qO4fV/w7Cx7J0Bbqk19KcRNdjt6eKoTnTPHBHlVHQIHZpMxacbFOAkJr # qAVkYZdz7ikNXTxV+GRb36tC4ByMNxE2DF7vFdvaiZP0CVZ5ByJ2gAhXM... |
| 2026-04-16T15:27:51.7881046-07:00 | background | PowerShell 4104 | scriptblock | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author = 'Microsoft ... |
| 2026-04-16T15:27:51.6616137-07:00 | background | PowerShell 4104 | scriptblock | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file exc... |
| 2026-04-16T15:27:51.3361798-07:00 | background | PowerShell 4104 | scriptblock | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } |
| 2026-04-16T15:27:51.3193035-07:00 | background | PowerShell 4104 | scriptblock | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } |
| 2026-04-16T15:27:51.3004843-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:27:51.0223297-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:27:50.8730386-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8730373-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8730332-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8730319-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8730306-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8730293-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8730255-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8730243-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8730230-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8730216-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8730198-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8730147-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:27:50.8309063-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0... |
| 2026-04-16T15:27:50.6750389-07:00 | background | PowerShell 4104 | scriptblock | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { $_.DisplayName -matc... |
| 2026-04-16T15:27:50.5378417-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_Op... |
| 2026-04-16T15:27:50.4294026-07:00 | background | Security 4688 | process | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --outdir .\reports |
| 2026-04-16T15:27:10.7546431-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T15:27:10.7228380-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T15:27:10.1677784-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe87_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe87_ Global\UsGthrCtrlFltPipeMssGthrPipe87 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T15:25:48.0923638-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:25:48.0840823-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzExNiwiY29u... |
| 2026-04-16T15:21:47.6214482-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T15:21:19.0273515-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T15:21:18.5616343-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T15:20:48.0782810-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:20:48.0667250-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-data-cleanup 6.211.47160 eyJjYW5jZWxFdmVudCI6MzYyNCwiY29uZmlndXJh... |
| 2026-04-16T15:20:32.4273340-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T15:20:32.3935136-07:00 | background | Security 4688 | process | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update |
| 2026-04-16T15:20:32.3311367-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T15:20:32.2965747-07:00 | background | Security 4688 | process | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal |
| 2026-04-16T15:20:32.2432748-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T15:20:32.2372815-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T15:20:32.1977279-07:00 | background | Security 4688 | process | updater.exe <= svchost.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system |
| 2026-04-16T15:18:33.5517162-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T15:18:12.7876101-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T15:18:07.7013263-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T15:18:07.6740247-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self... |
| 2026-04-16T15:18:07.6581915-07:00 | background | Security 4688 | process | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR-20260416-151729-LAB-HOST\windows_ir_stakehol... |
| 2026-04-16T15:18:07.6256397-07:00 | background | Security 4688 | process | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | C:\Windows\System32\smartscreen.exe -Embedding |
| 2026-04-16T15:17:51.1044870-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T15:17:45.4925767-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:17:42.7233249-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:17:42.6562689-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:17:42.4844085-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:17:42.3380595-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyC... |
| 2026-04-16T15:17:42.1923305-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Oper... |
| 2026-04-16T15:17:42.1783242-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:17:42.0955881-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:17:41.9236645-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:17:41.7807283-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... |
| 2026-04-16T15:17:41.6451729-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $... |
| 2026-04-16T15:17:41.6043550-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:17:39.6723708-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:17:39.6006529-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:17:39.4418893-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:17:39.2929344-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction Silen... |
| 2026-04-16T15:17:39.1481344-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/... |
| 2026-04-16T15:17:39.1338088-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:17:39.0525099-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:17:38.8745586-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:17:38.7295316-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... |
| 2026-04-16T15:17:38.5910363-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Def... |
| 2026-04-16T15:17:38.5760636-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:17:38.3865912-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:17:38.2858850-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:17:38.1058817-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:17:37.9978396-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObject]... |
| 2026-04-16T15:17:37.8561873-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).A... |
| 2026-04-16T15:17:37.8319673-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:17:32.5623702-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T15:17:32.4919257-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:17:32.3088692-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:17:32.1630113-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObjec... |
| 2026-04-16T15:17:32.0244970-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date)... |
| 2026-04-16T15:17:32.0050573-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T15:17:31.8214755-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T15:17:31.8092992-07:00 | background | PowerShell 4104 | scriptblock | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... |
| 2026-04-16T15:17:31.7980082-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:17:31.7092271-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:17:31.6205205-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:17:31.5733356-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:17:31.5163935-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:17:31.4423369-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:17:31.3726159-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:17:31.3034313-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:17:31.2208259-07:00 | background | PowerShell 4104 | scriptblock | Parameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSurfaceReductionRules_RuleSpecificExclusions'; ParameterType = 'System.String... | Parameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSurfaceReductionRules_RuleSpecificExclusions'; ParameterType = 'System.String'; Bindings = 'In'; ... |
| 2026-04-16T15:17:31.2208182-07:00 | background | PowerShell 4104 | scriptblock | PSBoundParameters.ContainsKey('AllowDatagramProcessingOnWinServer')) { [object]$__cmdletization_value = ${AllowDatagramProcessingOnWinServer} ... | PSBoundParameters.ContainsKey('AllowDatagramProcessingOnWinServer')) { [object]$__cmdletization_value = ${AllowDatagramProcessingOnWinServer} $__cmdletizat... |
| 2026-04-16T15:17:31.2208101-07:00 | background | PowerShell 4104 | scriptblock | _value = ${EnableFileHashComputation} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'EnableFileH... | _value = ${EnableFileHashComputation} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'EnableFileHashComputation'; Par... |
| 2026-04-16T15:17:31.2208019-07:00 | background | PowerShell 4104 | scriptblock | mdletization.MethodParameter]@{Name = 'UnknownThreatDefaultAction'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = ... | mdletization.MethodParameter]@{Name = 'UnknownThreatDefaultAction'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_def... |
| 2026-04-16T15:17:31.2207939-07:00 | background | PowerShell 4104 | scriptblock | ainsKey('DisableIntrusionPreventionSystem')) { [object]$__cmdletization_value = ${DisableIntrusionPreventionSystem} $__cmdletization_me... | ainsKey('DisableIntrusionPreventionSystem')) { [object]$__cmdletization_value = ${DisableIntrusionPreventionSystem} $__cmdletization_methodParameter = [Mic... |
| 2026-04-16T15:17:31.2207857-07:00 | background | PowerShell 4104 | scriptblock | er = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureScheduleTime'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bi... | er = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureScheduleTime'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; Value... |
| 2026-04-16T15:17:31.2207758-07:00 | background | PowerShell 4104 | scriptblock | gnaturesBeforeRunningScan')) { [object]$__cmdletization_value = ${CheckForSignaturesBeforeRunningScan} $__cmdletization_methodParameter... | gnaturesBeforeRunningScan')) { [object]$__cmdletization_value = ${CheckForSignaturesBeforeRunningScan} $__cmdletization_methodParameter = [Microsoft.PowerS... |
| 2026-04-16T15:17:31.2207675-07:00 | background | PowerShell 4104 | scriptblock | esent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionConfiguredState')) { [object]$__cmdletization_value = ${Remo... | esent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionConfiguredState')) { [object]$__cmdletization_value = ${RemoteEncryptionProtecti... |
| 2026-04-16T15:17:31.2207590-07:00 | background | PowerShell 4104 | scriptblock | ] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ProxyPacUrl}, [Parameter(ParameterSetName='Remove2')] [Alias('pro... | ] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ProxyPacUrl}, [Parameter(ParameterSetName='Remove2')] [Alias('proxsrv')] [Valida... |
| 2026-04-16T15:17:31.2207506-07:00 | background | PowerShell 4104 | scriptblock | dateNotNullOrEmpty()] [string[]] ${ExclusionExtension}, [Parameter(ParameterSetName='Remove2')] [ValidateNotNull()] [ValidateNotNu... | dateNotNullOrEmpty()] [string[]] ${ExclusionExtension}, [Parameter(ParameterSetName='Remove2')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [s... |
| 2026-04-16T15:17:31.2207418-07:00 | background | PowerShell 4104 | scriptblock | em.String[]'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdleti... | em.String[]'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParamet... |
| 2026-04-16T15:17:31.2207338-07:00 | background | PowerShell 4104 | scriptblock | ultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultVal... | ultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null ... |
| 2026-04-16T15:17:31.2207238-07:00 | background | PowerShell 4104 | scriptblock | = 'DefinitionUpdatesChannel'; ParameterType = 'Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.DefinitionUpdatesChannelType'; Bindings = 'In';... | = 'DefinitionUpdatesChannel'; ParameterType = 'Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.DefinitionUpdatesChannelType'; Bindings = 'In'; Value = $__cmdletiz... |
| 2026-04-16T15:17:31.2207147-07:00 | background | PowerShell 4104 | scriptblock | lueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = ... | lueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [obje... |
| 2026-04-16T15:17:31.2207056-07:00 | background | PowerShell 4104 | scriptblock | 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.A... | 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_... |
| 2026-04-16T15:17:31.2206961-07:00 | background | PowerShell 4104 | scriptblock | andomizeScheduleTaskTimes')) { [object]$__cmdletization_value = ${RandomizeScheduleTaskTimes} $__cmdletization_methodParameter = [Micro... | andomizeScheduleTaskTimes')) { [object]$__cmdletization_value = ${RandomizeScheduleTaskTimes} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdl... |
| 2026-04-16T15:17:31.2206863-07:00 | background | PowerShell 4104 | scriptblock | odParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundP... | odParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKe... |
| 2026-04-16T15:17:31.2206754-07:00 | background | PowerShell 4104 | scriptblock | ter]@{Name = 'ReportingCriticalFailureTimeOut'; ParameterType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__... | ter]@{Name = 'ReportingCriticalFailureTimeOut'; ParameterType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaul... |
| 2026-04-16T15:17:31.2206644-07:00 | background | PowerShell 4104 | scriptblock | lue; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'Ex... | lue; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ExclusionIpAddress'; P... |
| 2026-04-16T15:17:31.2206528-07:00 | background | PowerShell 4104 | scriptblock | et0')] [Alias('mtdefac')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.... | et0')] [Alias('mtdefac')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.ThreatAction] $... |
| 2026-04-16T15:17:31.2206414-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:17:31.0030801-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T15:17:30.9105569-07:00 | background | PowerShell 4104 | scriptblock | UEBhMC # VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV # BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEpMCcGA1UECxMgTWljcm9zb2Z0IE9w # ZXJhdGlvbnM... | UEBhMC # VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV # BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEpMCcGA1UECxMgTWljcm9zb2Z0IE9w # ZXJhdGlvbnMgUHVlcnRvIFJpY28xJjA... |
| 2026-04-16T15:17:30.9105490-07:00 | background | PowerShell 4104 | scriptblock | CI34CAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUA... | CI34CAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCRNShWem0qs5De # ... |
| 2026-04-16T15:17:30.9105269-07:00 | background | PowerShell 4104 | scriptblock | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author = 'Microsoft ... |
| 2026-04-16T15:17:30.8030756-07:00 | background | PowerShell 4104 | scriptblock | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file exc... |
| 2026-04-16T15:17:30.4794765-07:00 | background | PowerShell 4104 | scriptblock | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } |
| 2026-04-16T15:17:30.4637756-07:00 | background | PowerShell 4104 | scriptblock | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } |
| 2026-04-16T15:17:30.4452832-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T15:17:30.1674696-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T15:17:30.0018536-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:30.0018523-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:30.0018481-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:30.0018468-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:30.0018455-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:30.0018441-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:30.0018399-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:30.0018385-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:30.0018371-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:30.0018357-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:30.0018341-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:30.0018289-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T15:17:29.9580690-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0... |
| 2026-04-16T15:17:29.8214922-07:00 | background | PowerShell 4104 | scriptblock | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { $_.DisplayName -matc... |
| 2026-04-16T15:17:29.6739836-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_Op... |
| 2026-04-16T15:17:29.5543643-07:00 | background | Security 4688 | process | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --outdir .\reports |
| 2026-04-16T15:16:11.7807366-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T15:16:01.0086578-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T15:16:00.4836875-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe86_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe86_ Global\UsGthrCtrlFltPipeMssGthrPipe86 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T15:16:00.3541977-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T15:15:58.8247056-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T15:15:48.0675564-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:15:48.0592522-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzgzNiwiY29u... |
| 2026-04-16T15:15:09.7482519-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T15:15:09.7074718-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T15:15:07.5416799-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca |
| 2026-04-16T15:10:48.0721530-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:10:48.0483090-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-graphic-cards-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzQ5MiwiY... |
| 2026-04-16T15:10:47.8688467-07:00 | background | Security 4688 | process | vulnerability.scan.exe <= bdservicehost.exe | --hosts-verifier --start --proxy= --proxy-authentication= | --hosts-verifier --start --proxy= --proxy-authentication= |
| 2026-04-16T15:10:34.5183827-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T15:10:34.4768972-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T15:10:34.3645332-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T15:10:34.3302938-07:00 | background | Security 4688 | process | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False |
| 2026-04-16T15:10:34.2369931-07:00 | background | Security 4688 | process | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces |
| 2026-04-16T15:10:31.2777350-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T15:05:48.0418164-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:05:48.0351892-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzM2OCwiY29u... |
| 2026-04-16T15:03:33.4888458-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T15:00:58.8066393-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T15:00:48.0348694-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:00:48.0290474-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-battery-usage-summary-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6M... |
| 2026-04-16T15:00:28.3262332-07:00 | background | Security 4688 | process | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T15:00:28.3185237-07:00 | background | Security 4688 | process | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\_Shared\DiskCheck\ETD_GetSMART.exe" |
| 2026-04-16T15:00:10.7934876-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T14:55:48.0319186-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:55:48.0232274-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzQwNCwiY29u... |
| 2026-04-16T14:50:48.0345614-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:50:48.0235041-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-driver-inventory-summary-collector 6.211.47160 eyJjYW5jZWxFdmVudC... |
| 2026-04-16T14:49:22.6561939-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T14:49:20.5709361-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T14:49:16.7538630-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T14:48:33.4267669-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T14:46:19.8930289-07:00 | background | Security 4688 | process | SearchFilterHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchFilterHost.exe" 932 3496 3792 916 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421} | "C:\windows\System32\SearchFilterHost.exe" 932 3496 3792 916 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421} |
| 2026-04-16T14:46:19.8201897-07:00 | background | Security 4688 | process | SearchFilterHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchFilterHost.exe" 932 1848 2924 916 {4887767F-7ADC-4983-B576-88FB643D6F79} | "C:\windows\System32\SearchFilterHost.exe" 932 1848 2924 916 {4887767F-7ADC-4983-B576-88FB643D6F79} |
| 2026-04-16T14:46:19.1317136-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T14:46:18.3046773-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T14:46:17.8882009-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe85_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe85_ Global\UsGthrCtrlFltPipeMssGthrPipe85 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T14:45:58.8035217-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T14:45:48.0107035-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:45:48.0030626-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzE4NCwiY29u... |
| 2026-04-16T14:45:42.1184097-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:45:39.8964158-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca |
| 2026-04-16T14:45:05.2613384-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T14:44:35.1846323-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T14:44:22.6715601-07:00 | background | Security 4688 | process | MicrosoftEdgeUpdate.exe <= svchost.exe | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler |
| 2026-04-16T14:43:47.3220044-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:43:47.2829785-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T14:43:47.1540890-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T14:43:47.1207715-07:00 | background | Security 4688 | process | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False |
| 2026-04-16T14:43:47.0290145-07:00 | background | Security 4688 | process | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces |
| 2026-04-16T14:42:42.9349917-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:42:42.7721500-07:00 | background | Security 4688 | process | StoreDesktopExtension.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" ... | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" -Embedding |
| 2026-04-16T14:42:42.6958876-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gj... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gjh2mj.mca |
| 2026-04-16T14:42:42.6772515-07:00 | background | Security 4688 | process | StoreDesktopExtension.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" ... | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" -Embedding |
| 2026-04-16T14:42:42.6473877-07:00 | background | Security 4688 | process | Zoom.exe <= svchost.exe | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule |
| 2026-04-16T14:40:49.3537316-07:00 | background | Security 4688 | process | ProcInfo.exe <= hp-plugin-executor.exe | C:\ProgramData\HP\Telemetry\collectors\hp-telemetry-device-health-state-collector_ver_6.211.47160\ProcInfo.exe --hpd... | C:\ProgramData\HP\Telemetry\collectors\hp-telemetry-device-health-state-collector_ver_6.211.47160\ProcInfo.exe --hpdisplay C:\windows\TEMP\ProcInfo.xml |
| 2026-04-16T14:40:48.0002084-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:40:47.9901356-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-device-health-state-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzQ... |
| 2026-04-16T14:38:40.5181732-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC |
| 2026-04-16T14:38:40.4596968-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:38:40.4442170-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T14:38:40.4321155-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T14:38:40.4262134-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca |
| 2026-04-16T14:38:40.4258691-07:00 | background | Security 4688 | process | BackgroundTransferHost.exe <= svchost.exe | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 |
| 2026-04-16T14:38:40.4189129-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca |
| 2026-04-16T14:35:47.9968671-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:35:47.9883246-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6Mzg2MCwiY29u... |
| 2026-04-16T14:35:08.6220742-07:00 | background | Security 4688 | process | ProcInfo.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provide... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\ProcInfo\ProcInfo.exe" --time "C:\windows\SystemTemp\96ac147... |
| 2026-04-16T14:33:33.3551805-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T14:33:03.9635594-07:00 | background | Security 4688 | process | bdpatcher.exe <= bdredline.exe | "\\?\C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\redline_cl23_x64\bdpatcher.exe" | "\\?\C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\redline_cl23_x64\bdpatcher.exe" |
| 2026-04-16T14:32:44.0761292-07:00 | background | Security 4688 | process | conhost.exe <= sdbinst.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:32:44.0640713-07:00 | background | Security 4688 | process | sdbinst.exe <= svchost.exe | C:\windows\System32\sdbinst.exe -m -bg | C:\windows\System32\sdbinst.exe -m -bg |
| 2026-04-16T14:30:58.7997478-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T14:30:48.6669092-07:00 | background | Security 4688 | process | w32tm.exe <= cmd.exe | w32tm.exe /query /status /verbose | w32tm.exe /query /status /verbose |
| 2026-04-16T14:30:48.6496341-07:00 | background | Security 4688 | process | cmd.exe <= hp-plugin-executor.exe | C:\windows\system32\cmd.exe /c w32tm.exe /query /status /verbose | C:\windows\system32\cmd.exe /c w32tm.exe /query /status /verbose |
| 2026-04-16T14:30:47.9952056-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:30:47.9870431-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-real-time-clock-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzE5Miw... |
| 2026-04-16T14:30:17.0904792-07:00 | background | Security 4688 | process | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:30:17.0794179-07:00 | background | Security 4688 | process | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\_Shared\DiskCheck\ETD_GetSMART.exe" |
| 2026-04-16T14:30:16.6711845-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T14:26:24.4262619-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:26:24.3833404-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T14:26:24.2541872-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T14:26:24.1194009-07:00 | background | Security 4688 | process | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces |
| 2026-04-16T14:26:23.7561400-07:00 | background | Security 4688 | process | SystemSettings.exe <= svchost.exe | "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel | "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel |
| 2026-04-16T14:25:47.9812914-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:25:47.9700880-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6Mzk2MCwiY29u... |
| 2026-04-16T14:21:16.7195692-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T14:21:06.1923659-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T14:20:52.8658475-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T14:20:47.9765961-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:20:47.9663418-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-iolo-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzU4OCwiY29uZmlndX... |
| 2026-04-16T14:20:32.4110990-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T14:20:32.3776771-07:00 | background | Security 4688 | process | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update |
| 2026-04-16T14:20:32.3186992-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T14:20:32.2861297-07:00 | background | Security 4688 | process | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal |
| 2026-04-16T14:20:32.2436587-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T14:20:32.2312511-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T14:20:32.1941830-07:00 | background | Security 4688 | process | updater.exe <= svchost.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system |
| 2026-04-16T14:18:33.2810221-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T14:17:28.4926597-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC |
| 2026-04-16T14:17:28.4728796-07:00 | background | PowerShell 4104 | scriptblock | Get-StartApps | Get-StartApps |
| 2026-04-16T14:17:28.2508968-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:17:28.2084599-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T14:17:28.0721194-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T14:17:27.9453035-07:00 | background | Security 4688 | process | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces |
| 2026-04-16T14:17:27.9438613-07:00 | background | Security 4688 | process | wermgr.exe <= svchost.exe | "C:\windows\system32\wermgr.exe" -upload | "C:\windows\system32\wermgr.exe" -upload |
| 2026-04-16T14:17:04.6265973-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPPrinterControl.AppXg27tfcrjvepe7p6m0w5zs7c77x5b4h... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPPrinterControl.AppXg27tfcrjvepe7p6m0w5zs7c77x5b4hhe.mca |
| 2026-04-16T14:16:01.3411230-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T14:15:58.8096294-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T14:15:56.2628268-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:15:56.2391879-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self... |
| 2026-04-16T14:15:56.2237086-07:00 | background | Security 4688 | process | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR-20260416-141520-LAB-HOST\windows_ir_stakehol... |
| 2026-04-16T14:15:56.1901348-07:00 | background | Security 4688 | process | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | C:\Windows\System32\smartscreen.exe -Embedding |
| 2026-04-16T14:15:47.9645041-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:15:47.9563096-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MjE5NiwiY29u... |
| 2026-04-16T14:15:41.1968061-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T14:15:40.4579573-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe84_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe84_ Global\UsGthrCtrlFltPipeMssGthrPipe84 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T14:15:35.5729162-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T14:15:32.8547532-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T14:15:32.7840864-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T14:15:32.6438835-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T14:15:32.4850655-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyC... |
| 2026-04-16T14:15:32.3447094-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Oper... |
| 2026-04-16T14:15:32.3311343-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T14:15:32.2498090-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T14:15:32.0747594-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T14:15:31.9330205-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... |
| 2026-04-16T14:15:31.7969657-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $... |
| 2026-04-16T14:15:31.7575256-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T14:15:29.8712577-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T14:15:29.8011302-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T14:15:29.6687106-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T14:15:29.5201142-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction Silen... |
| 2026-04-16T14:15:29.3734667-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/... |
| 2026-04-16T14:15:29.3595803-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T14:15:29.2763269-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T14:15:29.1187657-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T14:15:28.9724989-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... |
| 2026-04-16T14:15:28.8319222-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Def... |
| 2026-04-16T14:15:28.8172016-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T14:15:28.6274798-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T14:15:28.5283798-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T14:15:28.3550224-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T14:15:28.1984804-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObject]... |
| 2026-04-16T14:15:28.0663153-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).A... |
| 2026-04-16T14:15:28.0433417-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T14:15:22.8325933-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T14:15:22.7660499-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T14:15:22.5947047-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T14:15:22.4642073-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObjec... |
| 2026-04-16T14:15:22.3270438-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date)... |
| 2026-04-16T14:15:22.3090600-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T14:15:22.1655269-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T14:15:22.1543963-07:00 | background | PowerShell 4104 | scriptblock | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... |
| 2026-04-16T14:15:22.1434393-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T14:15:22.0767550-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T14:15:21.9955488-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T14:15:21.9300192-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T14:15:21.8727409-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T14:15:21.7847681-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T14:15:21.7373426-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T14:15:21.6891551-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T14:15:21.6295560-07:00 | background | PowerShell 4104 | scriptblock | undParameters.ContainsKey('OobeEnableRtpAndSigUpdate')) { [object]$__cmdletization_value = ${OobeEnableRtpAndSigUpdate} $__cmdletizatio... | undParameters.ContainsKey('OobeEnableRtpAndSigUpdate')) { [object]$__cmdletization_value = ${OobeEnableRtpAndSigUpdate} $__cmdletization_methodParameter = ... |
| 2026-04-16T14:15:21.6295497-07:00 | background | PowerShell 4104 | scriptblock | on_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultV... | on_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $fal... |
| 2026-04-16T14:15:21.6295427-07:00 | background | PowerShell 4104 | scriptblock | { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableFtpParsing'; ParameterType = 'System.Man... | { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableFtpParsing'; ParameterType = 'System.Management.Automation.S... |
| 2026-04-16T14:15:21.6295343-07:00 | background | PowerShell 4104 | scriptblock | ndParameters.ContainsKey('AttackSurfaceReductionOnlyExclusions')) { [object]$__cmdletization_value = ${AttackSurfaceReductionOnlyExclusions} ... | ndParameters.ContainsKey('AttackSurfaceReductionOnlyExclusions')) { [object]$__cmdletization_value = ${AttackSurfaceReductionOnlyExclusions} $__cmdletizati... |
| 2026-04-16T14:15:21.6295253-07:00 | background | PowerShell 4104 | scriptblock | __cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletiza... | __cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter... |
| 2026-04-16T14:15:21.6295180-07:00 | background | PowerShell 4104 | scriptblock | e} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableIntrusionPreventionSy... | e} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableIntrusionPreventionSystem'; ParameterType... |
| 2026-04-16T14:15:21.6295100-07:00 | background | PowerShell 4104 | scriptblock | mdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureBlobFileSharesSources'; ParameterType = 'System.Managem... | mdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'SignatureBlobFileSharesSources'; ParameterType = 'System.Management.Automation.Switc... |
| 2026-04-16T14:15:21.6295024-07:00 | background | PowerShell 4104 | scriptblock | ScheduledScanOnly} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ThrottleForScheduledScanOnly';... | ScheduledScanOnly} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ThrottleForScheduledScanOnly'; ParameterType = 'Sy... |
| 2026-04-16T14:15:21.6294941-07:00 | background | PowerShell 4104 | scriptblock | __cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('ReportingA... | __cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('ReportingAdditionalActionTimeO... |
| 2026-04-16T14:15:21.6294863-07:00 | background | PowerShell 4104 | scriptblock | BoundParameters.ContainsKey('QuarantinePurgeItemsAfterDelay')) { [object]$__cmdletization_value = ${QuarantinePurgeItemsAfterDelay} $__... | BoundParameters.ContainsKey('QuarantinePurgeItemsAfterDelay')) { [object]$__cmdletization_value = ${QuarantinePurgeItemsAfterDelay} $__cmdletization_method... |
| 2026-04-16T14:15:21.6294770-07:00 | background | PowerShell 4104 | scriptblock | [Alias('proxbps')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ProxyBypass}, [Parameter(ParameterSetName='Remove2')]... | [Alias('proxbps')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ProxyBypass}, [Parameter(ParameterSetName='Remove2')] [Alias('fupo')... |
| 2026-04-16T14:15:21.6294673-07:00 | background | PowerShell 4104 | scriptblock | arameterSetName='Remove2')] [Alias('shri')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ServiceHealthReportInterval}, ... | arameterSetName='Remove2')] [Alias('shri')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [switch] ${ServiceHealthReportInterval}, [Parameter(Pa... |
| 2026-04-16T14:15:21.6294604-07:00 | background | PowerShell 4104 | scriptblock | } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]... | } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_def... |
| 2026-04-16T14:15:21.6294532-07:00 | background | PowerShell 4104 | scriptblock | ystem.Int32'; Bindings = 'Error'; Value = $null; IsValuePresent = $false } $__cmdletization_methodInvocationInfo = [Microsoft.PowerShell.Cmdletization... | ystem.Int32'; Bindings = 'Error'; Value = $null; IsValuePresent = $false } $__cmdletization_methodInvocationInfo = [Microsoft.PowerShell.Cmdletization.MethodInvocationInf... |
| 2026-04-16T14:15:21.6294462-07:00 | background | PowerShell 4104 | scriptblock | dParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableQuicParsing'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $_... | dParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableQuicParsing'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_defau... |
| 2026-04-16T14:15:21.6294390-07:00 | background | PowerShell 4104 | scriptblock | ent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DefinitionUpdatesC... | ent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DefinitionUpdatesChannel'; ParameterTy... |
| 2026-04-16T14:15:21.6294313-07:00 | background | PowerShell 4104 | scriptblock | er]@{Name = 'EnableFileHashComputation'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} ... | er]@{Name = 'EnableFileHashComputation'; ParameterType = 'System.Boolean'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { ... |
| 2026-04-16T14:15:21.6294244-07:00 | background | PowerShell 4104 | scriptblock | orce')) { [object]$__cmdletization_value = ${Force} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParame... | orce')) { [object]$__cmdletization_value = ${Force} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'cim:op... |
| 2026-04-16T14:15:21.6294172-07:00 | background | PowerShell 4104 | scriptblock | Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $fal... | Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSB... |
| 2026-04-16T14:15:21.6294103-07:00 | background | PowerShell 4104 | scriptblock | Present} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null... | Present} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$_... |
| 2026-04-16T14:15:21.6294017-07:00 | background | PowerShell 4104 | scriptblock | on_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('SharedSignaturesPath')) { [object]$__cmdletization_value = ${Shared... | on_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('SharedSignaturesPath')) { [object]$__cmdletization_value = ${SharedSignaturesPath} ... |
| 2026-04-16T14:15:21.6293939-07:00 | background | PowerShell 4104 | scriptblock | etization_value = ${ScanAvgCPULoadFactor} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ScanAvg... | etization_value = ${ScanAvgCPULoadFactor} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ScanAvgCPULoadFactor'; Para... |
| 2026-04-16T14:15:21.6293822-07:00 | background | PowerShell 4104 | scriptblock | ation_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionAggressiveness')) { [object]$__cmdleti... | ation_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProtectionAggressiveness')) { [object]$__cmdletization_value = ${Rem... |
| 2026-04-16T14:15:21.6293652-07:00 | background | PowerShell 4104 | scriptblock | eReductionRules_RuleSpecificExclusions}, [Parameter(ParameterSetName='Set0')] [Alias('oobers')] [ValidateNotNull()] [ValidateNotNullOrE... | eReductionRules_RuleSpecificExclusions}, [Parameter(ParameterSetName='Set0')] [Alias('oobers')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ... |
| 2026-04-16T14:15:21.6293564-07:00 | background | PowerShell 4104 | scriptblock | sableIntrusionPreventionSystem}, [Parameter(ParameterSetName='Set0')] [Alias('dioavp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] ... | sableIntrusionPreventionSystem}, [Parameter(ParameterSetName='Set0')] [Alias('dioavp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${D... |
| 2026-04-16T14:15:21.6293476-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T14:15:21.4243127-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T14:15:21.3333176-07:00 | background | PowerShell 4104 | scriptblock | UHAQEEUjBQME4GCCsGAQUFBzAChkJodHRwOi8vd3d3Lm1p # Y3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y # Mi5jcnQwgZ8GA1UdIASBlzCBlDCBkQYJKwYBBAG... | UHAQEEUjBQME4GCCsGAQUFBzAChkJodHRwOi8vd3d3Lm1p # Y3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y # Mi5jcnQwgZ8GA1UdIASBlzCBlDCBkQYJKwYBBAGCNy4DMIGDMD8GCCsGAQU... |
| 2026-04-16T14:15:21.3333102-07:00 | background | PowerShell 4104 | scriptblock | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author = 'Microsoft ... |
| 2026-04-16T14:15:21.2037649-07:00 | background | PowerShell 4104 | scriptblock | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file exc... |
| 2026-04-16T14:15:20.8944048-07:00 | background | PowerShell 4104 | scriptblock | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } |
| 2026-04-16T14:15:20.8799894-07:00 | background | PowerShell 4104 | scriptblock | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } |
| 2026-04-16T14:15:20.8624773-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T14:15:20.5843389-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T14:15:20.4154483-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.4154470-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.4154458-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.4154445-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.4154389-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.4154376-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.4154364-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.4154350-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.4154310-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.4154297-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.4154283-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.4154263-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T14:15:20.3706267-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0... |
| 2026-04-16T14:15:20.2110078-07:00 | background | PowerShell 4104 | scriptblock | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { $_.DisplayName -matc... |
| 2026-04-16T14:15:20.0730851-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_Op... |
| 2026-04-16T14:15:19.9598634-07:00 | background | Security 4688 | process | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --outdir .\reports |
| 2026-04-16T14:15:10.9996131-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T14:13:27.5786854-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T14:13:23.9584368-07:00 | background | Security 4688 | process | sppsvc.exe <= services.exe | C:\windows\system32\sppsvc.exe | C:\windows\system32\sppsvc.exe |
| 2026-04-16T14:13:03.6091331-07:00 | background | Security 4688 | process | SystemSettings.exe <= svchost.exe | "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel | "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel |
| 2026-04-16T14:11:07.2395652-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T14:11:05.4320442-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:10:58.2676910-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:10:54.6248170-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T14:10:53.7401824-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe83_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe83_ Global\UsGthrCtrlFltPipeMssGthrPipe83 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T14:10:53.1114518-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:10:48.9365149-07:00 | background | Security 4688 | process | UserOOBEBroker.exe <= svchost.exe | C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding | C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding |
| 2026-04-16T14:10:47.9492085-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:10:47.9433300-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-drivers-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzQ5MiwiY29uZml... |
| 2026-04-16T14:10:47.8602401-07:00 | background | Security 4688 | process | vulnerability.scan.exe <= bdservicehost.exe | --hosts-verifier --start --proxy= --proxy-authentication= | --hosts-verifier --start --proxy= --proxy-authentication= |
| 2026-04-16T14:10:18.8155182-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T14:10:18.0189405-07:00 | background | Security 4688 | process | bdfvwiz.exe <= bdservicehost.exe | "C:\Program Files\Bitdefender\Bitdefender Security\bdfvwiz.exe" --type=model --path=C:\Users\labuser\AppData\Local\Temp\bdfC... | "C:\Program Files\Bitdefender\Bitdefender Security\bdfvwiz.exe" --type=model --path=C:\Users\labuser\AppData\Local\Temp\bdfC86F.tmp |
| 2026-04-16T14:09:49.1281722-07:00 | background | Security 4688 | process | bdfvwiz.exe <= bdservicehost.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\bdfvwiz.exe" --type=view --path=C:\Users\labuser\AppData\Local\Temp\b... | "C:\Program Files\Bitdefender\Bitdefender Security App\bdfvwiz.exe" --type=view --path=C:\Users\labuser\AppData\Local\Temp\bdf5746.tmp |
| 2026-04-16T14:09:49.0427802-07:00 | background | Security 4688 | process | bdfvwiz.exe <= seccenter.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\bdfvwiz.exe" --type=view --path=C:\Users\labuser\AppData\Local\Temp\bdf57... | "C:\Program Files\Bitdefender\Bitdefender Security App\bdfvwiz.exe" --type=view --path=C:\Users\labuser\AppData\Local\Temp\bdf5746.tmp |
| 2026-04-16T14:09:35.4488625-07:00 | background | Security 4688 | process | seccenter.exe <= bdservicehost.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\seccenter.exe" source:systray | "C:\Program Files\Bitdefender\Bitdefender Security App\seccenter.exe" source:systray |
| 2026-04-16T14:09:35.3323135-07:00 | background | Security 4688 | process | seccenter.exe <= bdagent.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\seccenter.exe" source:systray | "C:\Program Files\Bitdefender\Bitdefender Security App\seccenter.exe" source:systray |
| 2026-04-16T14:08:43.0383537-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T14:08:35.0121960-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{9F156763-7844-4DC4-B2B1-901F640F5155} | "C:\windows\system32\DllHost.exe" /Processid:{9F156763-7844-4DC4-B2B1-901F640F5155} |
| 2026-04-16T14:08:25.6211141-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T14:08:25.0871920-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T14:07:56.1698502-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:07:50.5650166-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:07:41.3773656-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:07:30.4988131-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:07:07.2501367-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:07:02.1597528-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:07:00.3017658-07:00 | background | Security 4688 | process | TiWorker.exe <= svchost.exe | C:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8247_none_a53a4f5b773e04f9\TiWorker.exe -E... | C:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8247_none_a53a4f5b773e04f9\TiWorker.exe -Embedding |
| 2026-04-16T14:07:00.2643962-07:00 | background | Security 4688 | process | TrustedInstaller.exe <= services.exe | C:\windows\servicing\TrustedInstaller.exe | C:\windows\servicing\TrustedInstaller.exe |
| 2026-04-16T14:06:59.2331408-07:00 | background | Security 4688 | process | sppsvc.exe <= services.exe | C:\windows\system32\sppsvc.exe | C:\windows\system32\sppsvc.exe |
| 2026-04-16T14:06:57.3944613-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:06:51.0037242-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:06:43.6279307-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:06:37.9946059-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T14:06:37.9698150-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:06:37.9108417-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T14:06:37.8874613-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca |
| 2026-04-16T14:06:35.1712214-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:06:35.1196229-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T14:06:35.0004623-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T14:06:34.9836825-07:00 | background | Security 4688 | process | taskhostw.exe <= svchost.exe | taskhostw.exe | taskhostw.exe |
| 2026-04-16T14:06:34.6673261-07:00 | background | Security 4688 | process | Taskmgr.exe <= Taskmgr.exe | "C:\windows\system32\Taskmgr.exe" | "C:\windows\system32\Taskmgr.exe" |
| 2026-04-16T14:06:34.5985579-07:00 | background | Security 4688 | process | consent.exe <= svchost.exe | consent.exe 4976 448 0000025EA21CB7D0 | consent.exe 4976 448 0000025EA21CB7D0 |
| 2026-04-16T14:06:34.5447508-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:06:29.4238828-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:06:01.2537508-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T14:06:00.8621657-07:00 | background | Security 4688 | process | OpenConsole.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wekyb3d8bbwe\OpenConsole.exe" -Embedding | "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wekyb3d8bbwe\OpenConsole.exe" -Embedding |
| 2026-04-16T14:06:00.8424219-07:00 | background | Security 4688 | process | conhost.exe <= powershell.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:06:00.8423390-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:05:56.2499839-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T14:05:55.3334431-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe82_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe82_ Global\UsGthrCtrlFltPipeMssGthrPipe82 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T14:05:54.8940068-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:05:47.9735993-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:05:47.9380069-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6NDA4OCwiY29u... |
| 2026-04-16T14:05:47.6717279-07:00 | background | Security 4688 | process | OpenConsole.exe <= svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wekyb3d8bbwe\OpenConsole.exe" -Embedding | "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wekyb3d8bbwe\OpenConsole.exe" -Embedding |
| 2026-04-16T14:05:47.6520635-07:00 | background | Security 4688 | process | conhost.exe <= cmd.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:05:47.6520100-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:05:27.7227063-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:05:21.8070367-07:00 | background | PowerShell 4104 | scriptblock | $Host | $Host |
| 2026-04-16T14:05:21.7721114-07:00 | background | PowerShell 4104 | scriptblock | prompt | prompt |
| 2026-04-16T14:05:21.5774297-07:00 | background | Security 4688 | process | OpenConsole.exe <= WindowsTerminal.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless ... | "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --textMeasurement graphemes --width 120 --height 30 --signal ... |
| 2026-04-16T14:05:21.3071202-07:00 | background | Security 4688 | process | WindowsTerminal.exe <= wt.exe | wt.exe -p {61c54bbd-c2c6-5271-96e7-009a87ff44bf} | wt.exe -p {61c54bbd-c2c6-5271-96e7-009a87ff44bf} |
| 2026-04-16T14:05:21.0527736-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} |
| 2026-04-16T14:05:20.9973437-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} |
| 2026-04-16T14:05:20.9334543-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} |
| 2026-04-16T14:05:04.8024165-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:05:04.7223934-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:05:03.5840465-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:05:03.4911340-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:04:28.5757623-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:04:28.5311047-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T14:04:23.7743545-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T14:04:16.6475567-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:04:13.0761752-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:04:12.9775686-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:04:12.9770118-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:03:33.5430322-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:03:33.5018811-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T14:03:33.4225117-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:03:33.3490078-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca |
| 2026-04-16T14:03:32.9744240-07:00 | background | Security 4688 | process | conhost.exe <= dumpcap.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:03:32.9667844-07:00 | background | Security 4688 | process | dumpcap.exe <= Wireshark.exe | "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -F pcapng -i \Device\NPF_{9F21DB48... | "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -F pcapng -i \Device\NPF_{9F21DB48-C59A-414C-830A-7A7F2C8891AC} --ifdescr Wi-Fi -y EN... |
| 2026-04-16T14:03:29.8522222-07:00 | background | Security 4688 | process | conhost.exe <= etwdump.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:03:29.8472683-07:00 | background | Security 4688 | process | etwdump.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-dlts --extcap-interface etwdump | "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-dlts --extcap-interface etwdump |
| 2026-04-16T14:03:29.8267943-07:00 | background | Security 4688 | process | USBPcapCMD.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --extcap-dlts --extcap-interface \\.\USBPcap1 | "C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --extcap-dlts --extcap-interface \\.\USBPcap1 |
| 2026-04-16T14:03:29.7593608-07:00 | background | Security 4688 | process | conhost.exe <= dumpcap.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:03:29.7520474-07:00 | background | Security 4688 | process | dumpcap.exe <= Wireshark.exe | "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S -D -L --signal-pipe 16068.dummy... | "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S -D -L --signal-pipe 16068.dummy -Z 2020 |
| 2026-04-16T14:03:29.5964673-07:00 | background | Security 4688 | process | conhost.exe <= etwdump.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:03:29.5907436-07:00 | background | Security 4688 | process | etwdump.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump | "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump |
| 2026-04-16T14:03:29.5525802-07:00 | background | Security 4688 | process | USBPcapCMD.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --extcap-config --extcap-interface \\.\USBPcap1 | "C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --extcap-config --extcap-interface \\.\USBPcap1 |
| 2026-04-16T14:03:29.5355263-07:00 | background | Security 4688 | process | conhost.exe <= etwdump.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:03:29.5265032-07:00 | background | Security 4688 | process | etwdump.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-interfaces --extcap-version=4.6 | "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-interfaces --extcap-version=4.6 |
| 2026-04-16T14:03:29.5261261-07:00 | background | Security 4688 | process | USBPcapCMD.exe <= Wireshark.exe | "C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --extcap-interfaces --extcap-version=4.6 | "C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --extcap-interfaces --extcap-version=4.6 |
| 2026-04-16T14:03:18.6040579-07:00 | background | Security 4688 | process | wermgr.exe <= svchost.exe | "C:\windows\system32\wermgr.exe" -upload | "C:\windows\system32\wermgr.exe" -upload |
| 2026-04-16T14:03:17.7579220-07:00 | background | Security 4688 | process | WerFault.exe <= svchost.exe | werfault.exe /h /shared Global\cced5e5a20634c278be26e1e3fc7e557 /t 21776 /p 31004 | werfault.exe /h /shared Global\cced5e5a20634c278be26e1e3fc7e557 /t 21776 /p 31004 |
| 2026-04-16T14:03:17.7167167-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k WerSvcGroup | C:\windows\System32\svchost.exe -k WerSvcGroup |
| 2026-04-16T14:03:08.4569371-07:00 | background | Security 4688 | process | Taskmgr.exe <= Taskmgr.exe | "C:\windows\system32\taskmgr.exe" /4 | "C:\windows\system32\taskmgr.exe" /4 |
| 2026-04-16T14:03:08.3800422-07:00 | background | Security 4688 | process | consent.exe <= svchost.exe | consent.exe 4976 452 0000025EA3633BF0 | consent.exe 4976 452 0000025EA3633BF0 |
| 2026-04-16T14:02:12.8447930-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k netsvcs -p -s wuauserv | C:\windows\system32\svchost.exe -k netsvcs -p -s wuauserv |
| 2026-04-16T14:02:12.7727092-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:02:12.7248881-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T14:02:12.5729601-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T14:02:12.5354483-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T14:02:12.4721155-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca | "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca |
| 2026-04-16T14:02:12.4106743-07:00 | background | Security 4688 | process | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces |
| 2026-04-16T14:02:12.3937041-07:00 | background | Security 4688 | process | taskhostw.exe <= svchost.exe | taskhostw.exe | taskhostw.exe |
| 2026-04-16T14:01:54.6784297-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T14:01:48.7745261-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T14:01:21.4270496-07:00 | background | Security 4688 | process | DataExchangeHost.exe <= svchost.exe | C:\Windows\System32\DataExchangeHost.exe -Embedding | C:\Windows\System32\DataExchangeHost.exe -Embedding |
| 2026-04-16T14:01:20.0499672-07:00 | background | Security 4688 | process | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" |
| 2026-04-16T14:01:13.0361015-07:00 | background | Security 4688 | process | conhost.exe <= cmd.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:01:11.9189425-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:01:11.7881697-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelServi... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_devic... |
| 2026-04-16T14:01:11.7859667-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --origin-trial-disabled-features=Canva... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-r... |
| 2026-04-16T14:01:11.7409066-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:01:11.7401887-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:01:11.7181703-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --top-chrome-webui --origin-trial-disabled-features=Canvas... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --top-chrome-webui --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-re... |
| 2026-04-16T14:01:10.1504621-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:01:10.1295223-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self... |
| 2026-04-16T14:00:58.7772866-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T14:00:57.6986386-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:00:57.6985266-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T14:00:57.6737004-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self... |
| 2026-04-16T14:00:57.6214703-07:00 | background | Security 4688 | process | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | C:\Windows\System32\smartscreen.exe -Embedding |
| 2026-04-16T14:00:52.6284683-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T14:00:49.0065302-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T14:00:48.9593625-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T14:00:47.9334515-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T14:00:47.9271376-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-network-outage-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzY4NCwi... |
| 2026-04-16T14:00:16.4403728-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe81_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe81_ Global\UsGthrCtrlFltPipeMssGthrPipe81 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T14:00:14.7367305-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T14:00:05.3080854-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T13:59:28.5111604-07:00 | background | Security 4688 | process | wermgr.exe <= svchost.exe | "C:\windows\system32\wermgr.exe" -upload | "C:\windows\system32\wermgr.exe" -upload |
| 2026-04-16T13:59:10.4753483-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T13:56:54.7463553-07:00 | background | Security 4688 | process | rundll32.exe <= msiexec.exe | rundll32.exe "C:\windows\Installer\MSI86BE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_101877437 7 HPOneAgentCustomAction... | rundll32.exe "C:\windows\Installer\MSI86BE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_101877437 7 HPOneAgentCustomActions!HPOneAgentCustomActions.HPOneCustomActions.Check... |
| 2026-04-16T13:56:54.6740970-07:00 | background | Security 4688 | process | rundll32.exe <= msiexec.exe | rundll32.exe "C:\windows\Installer\MSI8650.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_101877359 2 HPOneAgentCustomAction... | rundll32.exe "C:\windows\Installer\MSI8650.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_101877359 2 HPOneAgentCustomActions!HPOneAgentCustomActions.HPOneCustomActions.Remov... |
| 2026-04-16T13:56:54.6474513-07:00 | background | Security 4688 | process | msiexec.exe <= msiexec.exe | C:\Windows\System32\MsiExec.exe -Embedding 3F2490A49F9D96B19F0A79AFB2D1C23B E Global\MSI0000 | C:\Windows\System32\MsiExec.exe -Embedding 3F2490A49F9D96B19F0A79AFB2D1C23B E Global\MSI0000 |
| 2026-04-16T13:56:53.8453667-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost | C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost |
| 2026-04-16T13:56:52.8115404-07:00 | background | Security 4688 | process | msiexec.exe <= services.exe | C:\windows\system32\msiexec.exe /V | C:\windows\system32\msiexec.exe /V |
| 2026-04-16T13:56:52.4775688-07:00 | background | Security 4688 | process | vc_redist.x64.exe <= vc_redist.x64.exe | "C:\windows\Temp\{215F1C21-273A-45A5-9082-9DEA74C518A9}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Pack... | "C:\windows\Temp\{215F1C21-273A-45A5-9082-9DEA74C518A9}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\20E2D7437367CB262CE45184EB4D809249FE654AA450D226E37... |
| 2026-04-16T13:56:52.2737414-07:00 | background | Security 4688 | process | vc_redist.x64.exe <= HPOneAgent.exe | "C:\ProgramData\Package Cache\20E2D7437367CB262CE45184EB4D809249FE654AA450D226E376D4057C00B58E\vc_redist.x64.exe" -burn... | "C:\ProgramData\Package Cache\20E2D7437367CB262CE45184EB4D809249FE654AA450D226E376D4057C00B58E\vc_redist.x64.exe" -burn.embedded BurnPipe.{0B636DC5-11C6-4696-8EEB-C28AA7958756} ... |
| 2026-04-16T13:56:50.7931555-07:00 | background | Security 4688 | process | HPOneAgent.exe <= HPOneAgent.exe | "C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe" -q -burn.elevated BurnPipe.{C5CE82A4-... | "C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe" -q -burn.elevated BurnPipe.{C5CE82A4-7EA8-4EF4-BCB7-F211EA9C72BE} {2E70231C-3ADE-44AC-8F68-7... |
| 2026-04-16T13:56:50.7141751-07:00 | background | Security 4688 | process | HPOneAgent.exe <= HPOneAgent.exe | "C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe" -burn.clean.room="C:\ProgramData\Pack... | "C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe" -burn.clean.room="C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneA... |
| 2026-04-16T13:56:50.6830377-07:00 | background | Security 4688 | process | HPOneAgent.exe <= svchost.exe | "C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe" /s /v /qn /min /repair /norestart FiredF... | "C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe" /s /v /qn /min /repair /norestart FiredFromScheduler=yes |
| 2026-04-16T13:55:47.9314409-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:55:47.9255724-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6NDA0OCwiY29u... |
| 2026-04-16T13:55:23.0780912-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T13:55:14.3287540-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T13:55:02.3132619-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T13:51:07.9388774-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T13:51:02.8375717-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T13:51:02.8122368-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self... |
| 2026-04-16T13:51:02.7986015-07:00 | background | Security 4688 | process | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR-20260416-135023-LAB-HOST\windows_ir_stakehol... |
| 2026-04-16T13:51:02.7661912-07:00 | background | Security 4688 | process | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | C:\Windows\System32\smartscreen.exe -Embedding |
| 2026-04-16T13:50:48.4220289-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T13:50:47.9250386-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:50:47.9150464-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-windows-events-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6Mzg5Miwi... |
| 2026-04-16T13:50:38.8684360-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:50:36.1442851-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T13:50:36.0757222-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:50:35.8995533-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T13:50:35.7379971-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyC... |
| 2026-04-16T13:50:35.5930781-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Oper... |
| 2026-04-16T13:50:35.5785746-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:50:35.4984781-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:50:35.3200665-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T13:50:35.1619607-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... |
| 2026-04-16T13:50:35.0198668-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $... |
| 2026-04-16T13:50:34.9810527-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:50:33.1848663-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T13:50:33.1119742-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:50:32.9573731-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T13:50:32.8535215-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction Silen... |
| 2026-04-16T13:50:32.7005303-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/... |
| 2026-04-16T13:50:32.6851945-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:50:32.6044997-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:50:32.4376782-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T13:50:32.2831349-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... |
| 2026-04-16T13:50:32.1391488-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Def... |
| 2026-04-16T13:50:32.1228995-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:50:31.9311030-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T13:50:31.8286901-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:50:31.6603409-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T13:50:31.5141498-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... | $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObject]... |
| 2026-04-16T13:50:31.3737272-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).A... |
| 2026-04-16T13:50:31.3492681-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:50:26.2928694-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T13:50:26.2248316-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:50:26.0685576-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T13:50:25.9039748-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)... | $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObjec... |
| 2026-04-16T13:50:25.7656475-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date)... |
| 2026-04-16T13:50:25.7456886-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:50:25.6111408-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T13:50:25.6000979-07:00 | background | PowerShell 4104 | scriptblock | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... | function __cmdletization_BindCommonParameters { param( $__cmdletization_objectModelWrapper, $myPSBoundParameters ) ... |
| 2026-04-16T13:50:25.5887233-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T13:50:25.4976224-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T13:50:25.4397449-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T13:50:25.3732573-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T13:50:25.3057687-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T13:50:25.2254560-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T13:50:25.1609299-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T13:50:25.1134802-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T13:50:25.0478842-07:00 | background | PowerShell 4104 | scriptblock | dPoolCap} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'RemoveScanningThreadPoolCap'; Parameter... | dPoolCap} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'RemoveScanningThreadPoolCap'; ParameterType = 'System.Manag... |
| 2026-04-16T13:50:25.0478792-07:00 | background | PowerShell 4104 | scriptblock | ystem.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdlet... | ystem.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParame... |
| 2026-04-16T13:50:25.0478721-07:00 | background | PowerShell 4104 | scriptblock | sent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AllowDatagramProc... | sent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AllowDatagramProcessingOnWinServer'; ... |
| 2026-04-16T13:50:25.0478664-07:00 | background | PowerShell 4104 | scriptblock | else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableTlsParsing'; ParameterType = 'Syste... | else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableTlsParsing'; ParameterType = 'System.Management.Automat... |
| 2026-04-16T13:50:25.0478601-07:00 | background | PowerShell 4104 | scriptblock | } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ControlledFolderAccessAllowedApplication... | } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ControlledFolderAccessAllowedApplications'; ParameterType = ... |
| 2026-04-16T13:50:25.0478520-07:00 | background | PowerShell 4104 | scriptblock | meter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'LowThreatDefaultAction'; ParameterType = 'System.Management.Automation.SwitchParameter'... | meter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'LowThreatDefaultAction'; ParameterType = 'System.Management.Automation.SwitchParameter'; Bindings = 'In'; V... |
| 2026-04-16T13:50:25.0478453-07:00 | background | PowerShell 4104 | scriptblock | Value; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) ... | Value; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$_... |
| 2026-04-16T13:50:25.0478389-07:00 | background | PowerShell 4104 | scriptblock | dParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPr... | dParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false ... |
| 2026-04-16T13:50:25.0478320-07:00 | background | PowerShell 4104 | scriptblock | on_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('SignatureUpdateInterval')) { [object]$__cmdletization_value = ${Sig... | on_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('SignatureUpdateInterval')) { [object]$__cmdletization_value = ${SignatureUpdateInterval... |
| 2026-04-16T13:50:25.0478258-07:00 | background | PowerShell 4104 | scriptblock | ystem.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdlet... | ystem.Management.Automation.SwitchParameter'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParame... |
| 2026-04-16T13:50:25.0478193-07:00 | background | PowerShell 4104 | scriptblock | ValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'Reporting... | ValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'ReportingNonCriticalTimeOut';... |
| 2026-04-16T13:50:25.0478125-07:00 | background | PowerShell 4104 | scriptblock | [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('R... | [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('RemoteEncryptionProte... |
| 2026-04-16T13:50:25.0478056-07:00 | background | PowerShell 4104 | scriptblock | cmdletization_objectModelWrapper -is [System.Management.Automation.IDynamicParameters]) { ([System.Management.Automatio... | cmdletization_objectModelWrapper -is [System.Management.Automation.IDynamicParameters]) { ([System.Management.Automation.IDynamicParameters... |
| 2026-04-16T13:50:25.0477991-07:00 | background | PowerShell 4104 | scriptblock | [ValidateNotNullOrEmpty()] [switch] ${LowThreatDefaultAction}, [Parameter(ParameterSetName='Remove2')] [Alias('mtdefac')] [Validat... | [ValidateNotNullOrEmpty()] [switch] ${LowThreatDefaultAction}, [Parameter(ParameterSetName='Remove2')] [Alias('mtdefac')] [ValidateNotNull()] [Va... |
| 2026-04-16T13:50:25.0477921-07:00 | background | PowerShell 4104 | scriptblock | ] [ValidateNotNullOrEmpty()] [string[]] ${BruteForceProtectionExclusions}, [Parameter(ParameterSetName='Remove2')] [Alias('bfplnb'... | ] [ValidateNotNullOrEmpty()] [string[]] ${BruteForceProtectionExclusions}, [Parameter(ParameterSetName='Remove2')] [Alias('bfplnb')] [ValidateNot... |
| 2026-04-16T13:50:25.0477866-07:00 | background | PowerShell 4104 | scriptblock | ue = ${AttackSurfaceReductionRules_Ids} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSur... | ue = ${AttackSurfaceReductionRules_Ids} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'AttackSurfaceReductionRules_I... |
| 2026-04-16T13:50:25.0477800-07:00 | background | PowerShell 4104 | scriptblock | [string[]] ${BruteForceProtectionExclusions}, [Parameter(ParameterSetName='Add1')] [switch] ${Force}, [Parameter(ParameterSetNam... | [string[]] ${BruteForceProtectionExclusions}, [Parameter(ParameterSetName='Add1')] [switch] ${Force}, [Parameter(ParameterSetName='Add1')] [Ali... |
| 2026-04-16T13:50:25.0477729-07:00 | background | PowerShell 4104 | scriptblock | hodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIs... | hodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false ... |
| 2026-04-16T13:50:25.0477673-07:00 | background | PowerShell 4104 | scriptblock | an'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.Powe... | an'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization... |
| 2026-04-16T13:50:25.0477606-07:00 | background | PowerShell 4104 | scriptblock | '; ParameterType = 'Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.UpdatesChannelType'; Bindings = 'In'; Value = $__cmdletization_value; IsVa... | '; ParameterType = 'Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.UpdatesChannelType'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} ... |
| 2026-04-16T13:50:25.0477515-07:00 | background | PowerShell 4104 | scriptblock | n'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletizati... | n'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@... |
| 2026-04-16T13:50:25.0477447-07:00 | background | PowerShell 4104 | scriptblock | ypes.MpPreference.PUAProtectionType'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} ... | ypes.MpPreference.PUAProtectionType'; Bindings = 'In'; Value = $__cmdletization_defaultValue; IsValuePresent = $__cmdletization_defaultValueIsPresent} } $__cmd... |
| 2026-04-16T13:50:25.0477367-07:00 | background | PowerShell 4104 | scriptblock | aultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('UILockdown')) { [o... | aultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if ($PSBoundParameters.ContainsKey('UILockdown')) { [object]$__cmdletizati... |
| 2026-04-16T13:50:25.0477297-07:00 | background | PowerShell 4104 | scriptblock | ; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'Disab... | ; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'DisableIOAVProtection'; P... |
| 2026-04-16T13:50:25.0477230-07:00 | background | PowerShell 4104 | scriptblock | ng')) { [object]$__cmdletization_value = ${DisableDatagramProcessing} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletiz... | ng')) { [object]$__cmdletization_value = ${DisableDatagramProcessing} $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParamete... |
| 2026-04-16T13:50:25.0477153-07:00 | background | PowerShell 4104 | scriptblock | = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__c... | = $__cmdletization_defaultValueIsPresent} } $__cmdletization_methodParameters.Add($__cmdletization_methodParameter) [object]$__cmdletization_default... |
| 2026-04-16T13:50:25.0477049-07:00 | background | PowerShell 4104 | scriptblock | e} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'CheckForSignaturesBeforeRunn... | e} } else { $__cmdletization_methodParameter = [Microsoft.PowerShell.Cmdletization.MethodParameter]@{Name = 'CheckForSignaturesBeforeRunningScan'; ParameterT... |
| 2026-04-16T13:50:25.0476962-07:00 | background | PowerShell 4104 | scriptblock | erType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParame... | erType = 'System.UInt32'; Bindings = 'In'; Value = $__cmdletization_value; IsValuePresent = $true} } else { $__cmdletization_methodParameter = [Microsoft.Pow... |
| 2026-04-16T13:50:25.0476714-07:00 | background | PowerShell 4104 | scriptblock | ers.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = ... | ers.Add($__cmdletization_methodParameter) [object]$__cmdletization_defaultValue = $null [object]$__cmdletization_defaultValueIsPresent = $false if (... |
| 2026-04-16T13:50:25.0476631-07:00 | background | PowerShell 4104 | scriptblock | meter(ParameterSetName='Set0')] [Alias('ddnstcpp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${DisableDnsOverTcpParsing... | meter(ParameterSetName='Set0')] [Alias('ddnstcpp')] [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${DisableDnsOverTcpParsing}, [Parameter... |
| 2026-04-16T13:50:25.0476570-07:00 | background | PowerShell 4104 | scriptblock | [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${MeteredConnectionUpdates}, [Parameter(ParameterSetName='Set0')] [Alias('an... | [ValidateNotNull()] [ValidateNotNullOrEmpty()] [bool] ${MeteredConnectionUpdates}, [Parameter(ParameterSetName='Set0')] [Alias('anpws')] [Validat... |
| 2026-04-16T13:50:25.0476490-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T13:50:24.8358549-07:00 | background | PowerShell 4104 | scriptblock | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module ... | #requires -version 3.0 try { Microsoft.PowerShell.Core\Set-StrictMode -Off } catch { } $script:MyModule = $MyInvocation.MyCommand.ScriptBlock.Module $script:ClassName =... |
| 2026-04-16T13:50:24.7290045-07:00 | background | PowerShell 4104 | scriptblock | PgcuKZvmPRul1LUd # d5Q54ulkyUQ9eHoj8xN9ppB0g430yyYCRirCihC7pKkFDJvtaPpoLpWgKj8qa1hJ # Yx8JaW5amJbkg/TAj/NGK978O9C9Ne9uJa7lryft0N3zDq+ZKJeYTQ49C/IIidYf # w... | PgcuKZvmPRul1LUd # d5Q54ulkyUQ9eHoj8xN9ppB0g430yyYCRirCihC7pKkFDJvtaPpoLpWgKj8qa1hJ # Yx8JaW5amJbkg/TAj/NGK978O9C9Ne9uJa7lryft0N3zDq+ZKJeYTQ49C/IIidYf # wzIY4vDFLc5bnrRJOQrGC... |
| 2026-04-16T13:50:24.7289971-07:00 | background | PowerShell 4104 | scriptblock | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author ... | @{ RootModule = 'PSModule.psm1' ModuleVersion = '2.2.5' GUID = '1d73a601-4a6c-43c5-ba3f-619b18bbb404' Author = 'Microsoft ... |
| 2026-04-16T13:50:24.5870257-07:00 | background | PowerShell 4104 | scriptblock | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may n... | ### # ==++== # # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file exc... |
| 2026-04-16T13:50:24.2776569-07:00 | background | PowerShell 4104 | scriptblock | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } | { $_.Name -like 'sysmon*' -or $_.DisplayName -like '*Sysmon*' } |
| 2026-04-16T13:50:24.2627744-07:00 | background | PowerShell 4104 | scriptblock | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } | { $_.DisplayName -match 'Bitdefender' -or $_.Name -match '^bd' } |
| 2026-04-16T13:50:24.2443435-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:50:23.9817630-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T13:50:23.8071523-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.8071509-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.8071474-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.8071462-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.8071449-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.8071436-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.8071382-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.8071369-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.8071356-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.8071342-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.8071327-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.8071254-07:00 | background | PowerShell 4104 | scriptblock | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue | Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue |
| 2026-04-16T13:50:23.7686771-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation."... | @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0... |
| 2026-04-16T13:50:23.6191877-07:00 | background | PowerShell 4104 | scriptblock | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { ... | $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_OperatingSystem $bios = Get-CimInstance Win32_BIOS $bd = Get-Service | Where-Object { $_.DisplayName -matc... |
| 2026-04-16T13:50:23.4757305-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_Op... |
| 2026-04-16T13:50:23.3661081-07:00 | background | Security 4688 | process | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --outdir .\reports |
| 2026-04-16T13:50:11.3589401-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} |
| 2026-04-16T13:50:11.2763605-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} |
| 2026-04-16T13:50:11.1136235-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} |
| 2026-04-16T13:50:07.7061450-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T13:50:01.6066274-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe80_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe80_ Global\UsGthrCtrlFltPipeMssGthrPipe80 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T13:50:01.3449795-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T13:50:01.1641794-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T13:48:33.2100507-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T13:47:16.7335389-07:00 | background | Security 4688 | process | taskhostw.exe <= svchost.exe | taskhostw.exe | taskhostw.exe |
| 2026-04-16T13:46:43.4551065-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe79_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe79_ Global\UsGthrCtrlFltPipeMssGthrPipe79 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T13:46:32.8909287-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} |
| 2026-04-16T13:46:32.8007710-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} |
| 2026-04-16T13:46:32.6448829-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} |
| 2026-04-16T13:45:58.8133881-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T13:45:58.7735279-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T13:45:58.7569754-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXpybpk6fj2fe0gb0jan49e6dncngk3pa1.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXpybpk6fj2fe0gb0jan49e6dncngk3pa1.mca |
| 2026-04-16T13:45:47.9187726-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:45:47.9091211-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzU1MiwiY29u... |
| 2026-04-16T13:45:34.0441506-07:00 | background | Security 4688 | process | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:45:34.0315833-07:00 | background | Security 4688 | process | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\_Shared\DiskCheck\ETD_GetSMART.exe" |
| 2026-04-16T13:45:16.3344057-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T13:44:22.6688947-07:00 | background | Security 4688 | process | MicrosoftEdgeUpdate.exe <= svchost.exe | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler |
| 2026-04-16T13:42:42.9427323-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T13:42:42.6875655-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gj... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp5jabz9hecdcv40j8n3mwmx577gjh2mj.mca |
| 2026-04-16T13:42:42.6476418-07:00 | background | Security 4688 | process | Zoom.exe <= svchost.exe | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule | "C:\Users\labuser\AppData\Roaming\Zoom\bin\Zoom.exe" --action=UpdateSchedule |
| 2026-04-16T13:42:17.1333117-07:00 | background | Security 4688 | process | wermgr.exe <= svchost.exe | "C:\windows\system32\wermgr.exe" -upload | "C:\windows\system32\wermgr.exe" -upload |
| 2026-04-16T13:42:16.1406046-07:00 | background | Security 4688 | process | WerFault.exe <= svchost.exe | werfault.exe /h /shared Global\972100956a524594ae66c0be221e5e83 /t 17236 /p 17832 | werfault.exe /h /shared Global\972100956a524594ae66c0be221e5e83 /t 17236 /p 17832 |
| 2026-04-16T13:42:16.1033422-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k WerSvcGroup | C:\windows\System32\svchost.exe -k WerSvcGroup |
| 2026-04-16T13:42:01.4436111-07:00 | background | Security 4688 | process | Taskmgr.exe <= Taskmgr.exe | "C:\windows\system32\taskmgr.exe" /4 | "C:\windows\system32\taskmgr.exe" /4 |
| 2026-04-16T13:42:01.3678721-07:00 | background | Security 4688 | process | consent.exe <= svchost.exe | consent.exe 4976 452 0000025EA21CBDE0 | consent.exe 4976 452 0000025EA21CBDE0 |
| 2026-04-16T13:41:18.6110882-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T13:40:53.9832277-07:00 | background | Security 4688 | process | DataExchangeHost.exe <= svchost.exe | C:\Windows\System32\DataExchangeHost.exe -Embedding | C:\Windows\System32\DataExchangeHost.exe -Embedding |
| 2026-04-16T13:40:47.9147427-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:40:47.9044452-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-battery-usage-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MjI2NCwiY... |
| 2026-04-16T13:40:43.3487634-07:00 | background | Security 4688 | process | Notepad.exe <= explorer.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\Des... | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR-20260416-1330... |
| 2026-04-16T13:40:04.2964938-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T13:39:55.3070050-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T13:39:43.9828559-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --serv... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --... |
| 2026-04-16T13:37:58.6328644-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T13:37:58.6252050-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca |
| 2026-04-16T13:36:49.2152514-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T13:36:44.1216156-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T13:36:44.0917495-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Goog... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\labuser\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self... |
| 2026-04-16T13:36:44.0751671-07:00 | background | Security 4688 | process | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\labuser\Desktop\Windows-IR-Lab\reports\cases\IR-20260416-133046-LAB-HOST\windows_ir_stakehol... |
| 2026-04-16T13:36:44.0427578-07:00 | background | Security 4688 | process | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | C:\Windows\System32\smartscreen.exe -Embedding |
| 2026-04-16T13:36:15.8173320-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T13:36:15.7741032-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T13:36:13.5966025-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca |
| 2026-04-16T13:35:47.9099711-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:35:47.9009099-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzkyNCwiY29u... |
| 2026-04-16T13:35:07.7673512-07:00 | background | Security 4688 | process | ProcInfo.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provide... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\ProcInfo\ProcInfo.exe" --time "C:\windows\SystemTemp\b0fa103... |
| 2026-04-16T13:34:47.3607030-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T13:34:47.3222025-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T13:34:47.1986874-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T13:34:47.1729461-07:00 | background | Security 4688 | process | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False |
| 2026-04-16T13:34:47.0800444-07:00 | background | Security 4688 | process | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces |
| 2026-04-16T13:33:33.1496139-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T13:32:47.4899302-07:00 | background | Security 4688 | process | BackgroundTransferHost.exe <= svchost.exe | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 |
| 2026-04-16T13:32:47.4272842-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC | C:\windows\System32\svchost.exe -k wsappx -p -s ClipSVC |
| 2026-04-16T13:32:47.4082533-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T13:32:47.3356162-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX9r36fck1e5qg377a1zx0t7v4ncws1jaq.mca |
| 2026-04-16T13:32:43.9653902-07:00 | background | Security 4688 | process | conhost.exe <= sdbinst.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:32:43.9552471-07:00 | background | Security 4688 | process | sdbinst.exe <= svchost.exe | C:\windows\System32\sdbinst.exe -m -bg | C:\windows\System32\sdbinst.exe -m -bg |
| 2026-04-16T13:31:12.1322580-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T13:31:02.4723267-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:30:59.7498198-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T13:30:59.6820759-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:30:59.5158868-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T13:30:59.3818240-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -E... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyC... |
| 2026-04-16T13:30:59.2363494-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Oper... |
| 2026-04-16T13:30:59.2212041-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:30:59.1366571-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:30:59.0125988-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T13:30:58.8833524-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... | $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) ... |
| 2026-04-16T13:30:58.7659154-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T13:30:58.7454818-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $... |
| 2026-04-16T13:30:58.7050441-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:30:56.9430555-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T13:30:56.8726875-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:30:56.7152876-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T13:30:56.5569002-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logNam... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction Silen... |
| 2026-04-16T13:30:56.4178661-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/... |
| 2026-04-16T13:30:56.4029496-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:30:56.3218175-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:30:56.1671287-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corpora... | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersio... |
| 2026-04-16T13:30:56.0524200-07:00 | background | PowerShell 4104 | scriptblock | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $... | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction... |
| 2026-04-16T13:30:55.9143317-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Def... |
| 2026-04-16T13:30:55.8989436-07:00 | background | PowerShell 4104 | scriptblock | $global:? | $global:? |
| 2026-04-16T13:30:55.6921700-07:00 | background | PowerShell 4104 | scriptblock | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'D... | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... |
| 2026-04-16T13:30:55.5891263-07:00 | background | PowerShell 4104 | scriptblock | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ... | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0... |
| 2026-04-16T13:30:55.1175411-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).A... |
| 2026-04-16T13:30:49.2662285-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date)... |
| 2026-04-16T13:30:49.0584813-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T13:30:47.9156450-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:30:47.8951141-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-windows-updates-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzA2NCw... |
| 2026-04-16T13:30:46.8677872-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_Op... |
| 2026-04-16T13:30:46.7608104-07:00 | background | Security 4688 | process | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --outdir .\reports |
| 2026-04-16T13:30:32.9088808-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} |
| 2026-04-16T13:30:32.8270843-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} |
| 2026-04-16T13:30:32.6886268-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} |
| 2026-04-16T13:30:30.4214907-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T13:30:22.0508285-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T13:30:20.4697470-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T13:30:17.5517608-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} |
| 2026-04-16T13:30:17.4577490-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} |
| 2026-04-16T13:30:17.3058971-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} |
| 2026-04-16T13:30:10.7452115-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T13:28:34.5396935-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T13:27:43.2047263-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Sysmon/Oper... |
| 2026-04-16T13:27:42.6943818-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'PowerShellCore/Operational' $... |
| 2026-04-16T13:27:40.3967661-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/... |
| 2026-04-16T13:27:39.8326411-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Def... |
| 2026-04-16T13:27:39.0528214-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'System' $start = (Get-Date).A... |
| 2026-04-16T13:27:33.4902635-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName = 'Security' $start = (Get-Date)... |
| 2026-04-16T13:27:33.3377460-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding | C:\windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| 2026-04-16T13:27:31.1898209-07:00 | background | Security 4688 | process | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance ... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_ComputerSystem $os = Get-CimInstance Win32_Op... |
| 2026-04-16T13:27:31.0744323-07:00 | background | Security 4688 | process | python.exe <= pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --out... | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --outdir .\reports |
| 2026-04-16T13:27:19.2849429-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} | "C:\windows\SysWOW64\DllHost.exe" /Processid:{1C6DF0C0-192A-4451-BE36-6A59A86A692E} |
| 2026-04-16T13:27:19.1963565-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} | "C:\windows\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} |
| 2026-04-16T13:27:19.0449489-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} | "C:\windows\system32\DllHost.exe" /Processid:{325C7BE3-E00C-4943-ADC1-2387FD06E08E} |
| 2026-04-16T13:27:11.6835019-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-us... |
| 2026-04-16T13:27:10.0891788-07:00 | background | Security 4688 | process | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| 2026-04-16T13:27:09.5308958-07:00 | background | Security 4688 | process | SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe78_ Global\UsGthrCtrlFltPipeMssGthr... | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe78_ Global\UsGthrCtrlFltPipeMssGthrPipe78 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/... |
| 2026-04-16T13:26:20.5591962-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T13:25:47.8920160-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:25:47.8854682-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6NDA3NiwiY29u... |
| 2026-04-16T13:23:47.1625078-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T13:23:47.1221466-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T13:23:44.9429369-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXgx81f4t0vjvane7r4dtetjeh80p3nbpg.mca |
| 2026-04-16T13:21:35.7541717-07:00 | background | Security 4688 | process | SDXHelper.exe <= svchost.exe | "C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding | "C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding |
| 2026-04-16T13:21:35.6712023-07:00 | background | Security 4688 | process | SDXHelper.exe <= svchost.exe | "C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe" | "C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe" |
| 2026-04-16T13:20:47.8989941-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:20:47.8886908-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-storage-health-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzM2OCwi... |
| 2026-04-16T13:20:32.4056654-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T13:20:32.3754382-07:00 | background | Security 4688 | process | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update |
| 2026-04-16T13:20:32.3179419-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T13:20:32.2852167-07:00 | background | Security 4688 | process | updater.exe <= services.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal |
| 2026-04-16T13:20:32.2309478-07:00 | background | Security 4688 | process | updater.exe <= updater.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x8... | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --... |
| 2026-04-16T13:20:32.2251469-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T13:20:32.1899684-07:00 | background | Security 4688 | process | updater.exe <= svchost.exe | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system | "C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system |
| 2026-04-16T13:18:33.0780517-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T13:15:58.7473865-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T13:15:47.8758029-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:15:47.8692231-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MzA5MiwiY29u... |
| 2026-04-16T13:15:41.8868544-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T13:15:41.8449268-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T13:15:41.7275640-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T13:15:41.6949665-07:00 | background | Security 4688 | process | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylev... | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False |
| 2026-04-16T13:15:41.6025228-07:00 | background | Security 4688 | process | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces |
| 2026-04-16T13:15:22.6334456-07:00 | background | Security 4688 | process | conhost.exe <= ETD_GetSMART.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:15:22.6211866-07:00 | background | Security 4688 | process | ETD_GetSMART.exe <= TouchpointAnalyticsClientService.exe | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Pro... | "C:\windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_0f2b4c962c16d743\x64\Provider Data Sources\_Shared\DiskCheck\ETD_GetSMART.exe" |
| 2026-04-16T13:15:05.1969308-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T13:14:22.6746244-07:00 | background | Security 4688 | process | MicrosoftEdgeUpdate.exe <= svchost.exe | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c | "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c |
| 2026-04-16T13:11:10.5939050-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T13:10:52.9334518-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T13:10:52.8905483-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider |
| 2026-04-16T13:10:52.7635377-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc | C:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| 2026-04-16T13:10:52.6328681-07:00 | background | Security 4688 | process | MoUsoCoreWorker.exe <= svchost.exe | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces | "C:\windows\uus\packages\preview\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces |
| 2026-04-16T13:10:50.1444572-07:00 | background | Security 4688 | process | TiWorker.exe <= svchost.exe | C:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8247_none_a53a4f5b773e04f9\TiWorker.exe -E... | C:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8247_none_a53a4f5b773e04f9\TiWorker.exe -Embedding |
| 2026-04-16T13:10:50.1171564-07:00 | background | Security 4688 | process | TrustedInstaller.exe <= services.exe | C:\windows\servicing\TrustedInstaller.exe | C:\windows\servicing\TrustedInstaller.exe |
| 2026-04-16T13:10:50.1069914-07:00 | background | Security 4688 | process | smartscreen.exe <= svchost.exe | C:\Windows\System32\smartscreen.exe -Embedding | C:\Windows\System32\smartscreen.exe -Embedding |
| 2026-04-16T13:10:50.0768573-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\System32\svchost.exe -k netsvcs -p -s PushToInstall | C:\windows\System32\svchost.exe -k netsvcs -p -s PushToInstall |
| 2026-04-16T13:10:50.0668360-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k netsvcs -s LxpSvc | C:\windows\system32\svchost.exe -k netsvcs -s LxpSvc |
| 2026-04-16T13:10:50.0495873-07:00 | background | Security 4688 | process | conhost.exe <= sc.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:10:50.0366998-07:00 | background | Security 4688 | process | taskhostw.exe <= svchost.exe | taskhostw.exe | taskhostw.exe |
| 2026-04-16T13:10:50.0364592-07:00 | background | Security 4688 | process | sc.exe <= svchost.exe | "C:\windows\system32\sc.exe" start pushtoinstall login | "C:\windows\system32\sc.exe" start pushtoinstall login |
| 2026-04-16T13:10:47.8827296-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:10:47.8688016-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-device-location-info-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6Mz... |
| 2026-04-16T13:10:47.8501312-07:00 | background | Security 4688 | process | vulnerability.scan.exe <= bdservicehost.exe | --hosts-verifier --start --proxy= --proxy-authentication= | --hosts-verifier --start --proxy= --proxy-authentication= |
| 2026-04-16T13:07:37.3775891-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T13:07:25.9209000-07:00 | background | Security 4688 | process | CredentialUIBroker.exe <= svchost.exe | "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding | "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding |
| 2026-04-16T13:07:20.7358037-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T13:07:00.8940676-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T13:07:00.3656997-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T13:06:55.3577143-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T13:06:55.2593090-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T13:06:06.9307072-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca |
| 2026-04-16T13:05:47.8656213-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:05:47.8550280-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-peripheral-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MjUyMCwiY29u... |
| 2026-04-16T13:03:33.0008661-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k GPSvcGroup | C:\windows\system32\svchost.exe -k GPSvcGroup |
| 2026-04-16T13:03:13.3097678-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyC... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --video... |
| 2026-04-16T13:00:58.7385464-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca |
| 2026-04-16T13:00:47.8531515-07:00 | background | Security 4688 | process | conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
| 2026-04-16T13:00:47.8472929-07:00 | background | Security 4688 | process | hp-plugin-executor.exe <= hp-one-agent-service.exe | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-te... | "C:\Program Files\HP\HP One Agent\hp-plugin-executor.exe" "C:\ProgramData\HP\Telemetry\collectors" hp-telemetry-battery-report-collector 6.211.47160 eyJjYW5jZWxFdmVudCI6MjI3Miwi... |
| 2026-04-16T13:00:16.7027092-07:00 | background | Security 4688 | process | WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wmiprvse.exe -Embedding | C:\windows\system32\wbem\wmiprvse.exe -Embedding |
| 2026-04-16T12:59:49.0003157-07:00 | background | Security 4688 | process | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddin... | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-US --service-sandbox-type=o... |
| 2026-04-16T12:58:04.6331649-07:00 | background | Security 4688 | process | svchost.exe <= services.exe | C:\windows\system32\svchost.exe -k McpManagementServiceGroup | C:\windows\system32\svchost.exe -k McpManagementServiceGroup |
| 2026-04-16T12:58:03.2210884-07:00 | background | Security 4688 | process | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding | C:\Windows\System32\RuntimeBroker.exe -Embedding |
| 2026-04-16T12:58:03.1321273-07:00 | background | Security 4688 | process | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPPrinterControl.AppXg27tfcrjvepe7p6m0w5zs7c77x5b4h... | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPPrinterControl.AppXg27tfcrjvepe7p6m0w5zs7c77x5b4hhe.mca |
| 2026-04-16T12:58:02.8668363-07:00 | background | Security 4688 | process | conhost.exe <= wevtutil.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 |
Recent 4688 Process Executions
| Time | View | User | Image | Parent | Command Line | Why |
|---|---|---|---|---|---|---|
| 2026-04-16T16:57:12.2964681-07:00 | likely_user | labuser | C:\Users\labuser\Downloads\Windows Notepad Installer.exe | C:\Windows\explorer.exe | "C:\Users\labuser\Downloads\Windows Notepad Installer.exe" | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T16:56:06.9443720-07:00 | likely_user | labuser | C:\Windows\System32\Taskmgr.exe | C:\Windows\explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T16:54:01.4614101-07:00 | likely_user | labuser | C:\Windows\System32\Taskmgr.exe | C:\Windows\explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T16:45:21.0704054-07:00 | likely_user | labuser | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\... | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "DD1E5E92-DC37-4A7D-84A1-7DB2CDD24... | interactive user account |
| 2026-04-16T16:45:12.7882833-07:00 | likely_user | labuser | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\... | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "B7FE164E-4CCE-4502-AD82-E6D181ECA... | interactive user account |
| 2026-04-16T16:45:12.3206527-07:00 | likely_user | labuser | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\... | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\aimgr.exe" | interactive user account |
| 2026-04-16T16:45:12.2917914-07:00 | likely_user | labuser | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\... | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\aimgr.exe" | interactive user account |
| 2026-04-16T16:45:11.3249009-07:00 | likely_user | labuser | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE | C:\Windows\explorer.exe | "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE" | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T14:07:56.1522067-07:00 | likely_user | labuser | C:\Windows\System32\reg.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\reg.exe" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v IRTestRun /f | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:07:50.5459539-07:00 | likely_user | labuser | C:\Windows\System32\reg.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v IRTestRun /t REG_SZ /d notepad.exe /f | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:07:41.3546549-07:00 | likely_user | labuser | C:\Windows\System32\schtasks.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\schtasks.exe" /delete /tn IRTestTask /f | interactive user account; interactive parent: powershell.exe; script host / LOLBin / admin tool |
| 2026-04-16T14:07:30.4719301-07:00 | likely_user | labuser | C:\Windows\System32\schtasks.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\schtasks.exe" /create /sc once /tn IRTestTask /tr notepad.exe /st 23:59 /f | interactive user account; interactive parent: powershell.exe; script host / LOLBin / admin tool |
| 2026-04-16T14:07:07.0576214-07:00 | likely_user | labuser | C:\Windows\System32\NETSTAT.EXE | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\NETSTAT.EXE" -ano | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:07:02.1141920-07:00 | likely_user | labuser | C:\Windows\System32\whoami.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\whoami.exe" /all | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:06:57.2988993-07:00 | likely_user | labuser | C:\Windows\System32\ipconfig.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\ipconfig.exe" /all | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:06:50.7902724-07:00 | likely_user | labuser | C:\Windows\System32\schtasks.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\schtasks.exe" /query | interactive user account; interactive parent: powershell.exe; script host / LOLBin / admin tool |
| 2026-04-16T14:06:43.6075774-07:00 | likely_user | labuser | C:\Windows\System32\reg.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\reg.exe" query HKCU\Software | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:06:34.5377140-07:00 | likely_user | labuser | C:\Windows\System32\Taskmgr.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\Taskmgr.exe" | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:06:00.8308323-07:00 | likely_user | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Get-Process | Select-Object -First 5" | interactive user account; interactive parent: powershell.exe; script host / LOLBin / admin tool |
| 2026-04-16T14:05:47.6415047-07:00 | likely_user | labuser | C:\Windows\System32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\cmd.exe" /c echo test-from-cmd > "$env:USERPROFILE\Desktop\ir_test_cmd.txt" | interactive user account; interactive parent: powershell.exe; script host / LOLBin / admin tool |
| 2026-04-16T14:05:27.7254801-07:00 | likely_user | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8b... | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_... | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" /SESSION:XHqjvG+npU+27TfBmUH1... | interactive user account |
| 2026-04-16T14:05:27.6957006-07:00 | likely_user | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8b... | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | "C:\windows\system32\notepad.exe" | interactive user account; interactive parent: powershell.exe |
| 2026-04-16T14:05:21.5848398-07:00 | likely_user | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0... | C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe | interactive user account; script host / LOLBin / admin tool |
| 2026-04-16T14:05:21.1789212-07:00 | likely_user | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.20211.0_x64__8wekyb3d8... | C:\Windows\explorer.exe | "C:\Users\labuser\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe" -p {61c54bbd-c2c6-5271-96e7-009a87ff4... | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T14:03:29.1192334-07:00 | likely_user | labuser | C:\Program Files\Wireshark\Wireshark.exe | C:\Windows\explorer.exe | "C:\Program Files\Wireshark\Wireshark.exe" | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T14:03:17.7096708-07:00 | likely_user | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8b... | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_... | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" | interactive user account |
| 2026-04-16T14:03:08.3167830-07:00 | likely_user | labuser | C:\Windows\System32\Taskmgr.exe | C:\Windows\explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T14:01:13.0703067-07:00 | likely_user | labuser | C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe | C:\Windows\System32\cmd.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe" chrome-extension://khndhdhbebhaddchcgnalcjlaekbbeof/ --parent-... | browser-launched Bitdefender helper activity |
| 2026-04-16T14:01:13.0255373-07:00 | likely_user | labuser | C:\Windows\System32\cmd.exe | C:\Program Files\Google\Chrome\Application\chrome.exe | C:\windows\system32\cmd.exe /d /s /c ""C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe" chrome-extension://khndhd... | browser-launched Bitdefender helper activity |
| 2026-04-16T14:01:10.1114778-07:00 | likely_user | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | C:\Windows\explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T14:00:57.6545590-07:00 | likely_user | labuser | C:\Program Files\Google\Chrome\Application\chrome.exe | C:\Windows\explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T13:42:16.0972948-07:00 | likely_user | labuser | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8b... | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_... | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\Desktop\Windo... | interactive user account |
| 2026-04-16T13:42:01.2918435-07:00 | likely_user | labuser | C:\Windows\System32\Taskmgr.exe | C:\Windows\explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | interactive user account; interactive parent: explorer.exe |
| 2026-04-16T17:00:46.0887273-07:00 | background | labuser | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_Compu... | collector self-activity |
| 2026-04-16T17:00:45.9769673-07:00 | background | labuser | C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe | C:\Program Files\PowerShell\7\pwsh.exe | "C:\Users\labuser\AppData\Local\Programs\Python\Python312\python.exe" .\scripts\windows_ir_reporter.py --days 2 --max-events 800 --outdir .... | collector self-activity |
| 2026-04-16T16:57:36.5034759-07:00 | background | LAB-HOST$ | C:\Windows\System32\dllhost.exe | C:\Windows\System32\svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | service/background parent or machine account |
| 2026-04-16T16:57:36.4960389-07:00 | background | LAB-HOST$ | C:\Windows\System32\SearchProtocolHost.exe | C:\Windows\System32\SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe92_ Global\UsGthrCtrlFltPipeMssGthrPipe92 1 -2147483646 "Soft... | service/background parent or machine account |
| 2026-04-16T16:57:35.5030225-07:00 | background | LAB-HOST$ | C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8b... | C:\Windows\System32\svchost.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22602.1401.6.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" -Embedding | service/background parent or machine account |
| 2026-04-16T16:56:07.0709522-07:00 | background | LAB-HOST$ | C:\Windows\System32\Taskmgr.exe | C:\Windows\System32\Taskmgr.exe | "C:\windows\system32\taskmgr.exe" /4 | service/background parent or machine account |
| 2026-04-16T16:56:07.0034184-07:00 | background | LAB-HOST$ | C:\Windows\System32\consent.exe | C:\Windows\System32\svchost.exe | consent.exe 4976 452 0000025EA21BF430 | service/background parent or machine account |
Recent 4104 User-Entered Script Blocks
| Time | View | Script Block Text | Why |
|---|---|---|---|
| 2026-04-16T14:11:05.4295475-07:00 | likely_user | Remove-Item "$env:USERPROFILE\Desktop\ir_file_test_renamed.txt" | user-entered script block |
| 2026-04-16T14:10:58.2641530-07:00 | likely_user | Rename-Item "$env:USERPROFILE\Desktop\ir_file_test.txt" "ir_file_test_renamed.txt" | user-entered script block |
| 2026-04-16T14:10:53.0971982-07:00 | likely_user | echo test > "$env:USERPROFILE\Desktop\ir_file_test.txt" | user-entered script block |
| 2026-04-16T14:07:56.1513289-07:00 | likely_user | reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v IRTestRun /f | user-entered script block |
| 2026-04-16T14:07:50.5450904-07:00 | likely_user | reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v IRTestRun /t REG_SZ /d "notepad.exe" /f | user-entered script block |
| 2026-04-16T14:07:41.3538042-07:00 | likely_user | schtasks /delete /tn IRTestTask /f | user-entered script block |
| 2026-04-16T14:07:30.4709468-07:00 | likely_user | schtasks /create /sc once /tn IRTestTask /tr "notepad.exe" /st 23:59 /f | user-entered script block |
| 2026-04-16T14:07:07.0553429-07:00 | likely_user | netstat -ano | user-entered script block |
| 2026-04-16T14:07:02.1131368-07:00 | likely_user | whoami /all | user-entered script block |
| 2026-04-16T14:06:57.2979833-07:00 | likely_user | ipconfig /all | user-entered script block |
| 2026-04-16T14:06:50.7893683-07:00 | likely_user | schtasks /query | user-entered script block |
| 2026-04-16T14:06:43.6065777-07:00 | likely_user | reg query HKCU\Software | user-entered script block |
| 2026-04-16T14:06:34.5367202-07:00 | likely_user | taskmgr.exe | user-entered script block |
| 2026-04-16T14:06:28.9009668-07:00 | likely_user | Get-StartApps | user-entered script block |
| 2026-04-16T14:06:01.0964483-07:00 | likely_user | Get-Process | Select-Object -First 5 | user-entered script block |
| 2026-04-16T14:06:00.8273074-07:00 | likely_user | Start-Process powershell.exe -ArgumentList '-NoProfile -Command "Get-Process | Select-Object -First 5"' | user-entered script block |
| 2026-04-16T14:05:54.3257807-07:00 | likely_user | Invoke-WebRequest -Uri "https://example.com" -OutFile "$env:USERPROFILE\Desktop\example_test.html" | exact supportive scriptblock tied to strongest chain; contains dual-use or suspicious keywords |
| 2026-04-16T14:05:47.6081782-07:00 | likely_user | Start-Process cmd.exe -ArgumentList '/c echo test-from-cmd > "$env:USERPROFILE\Desktop\ir_test_cmd.txt"' | exact supportive scriptblock tied to strongest chain |
| 2026-04-16T14:05:27.6772009-07:00 | likely_user | notepad.exe | exact supportive scriptblock tied to strongest chain |
| 2026-04-16T17:00:55.9913467-07:00 | background | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersion = "7.0.0.0" CompatiblePSEditions = @(... | module / manifest / collector helper block |
| 2026-04-16T17:00:55.8250090-07:00 | background | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObject]@{ log... | module / manifest / collector helper block |
| 2026-04-16T17:00:55.6639409-07:00 | background | $global:? | module / manifest / collector helper block |
| 2026-04-16T17:00:55.5799072-07:00 | background | @{ GUID="CA046F10-CA64-4740-8FF9-2565DBA61A4F" Author="PowerShell" CompanyName="Microsoft Corporation" Copyright="Copyright (c) Microsoft Corporation." ModuleVersion="7.0.0.0" CompatiblePSEditions = @("Core") P... | module / manifest / collector helper block |
| 2026-04-16T17:00:55.4005734-07:00 | background | @{ GUID = "1DA87E53-152B-403E-98DC-74D7B4D63D59" Author = "PowerShell" CompanyName = "Microsoft Corporation" Copyright = "Copyright (c) Microsoft Corporation." ModuleVersion = "7.0.0.0" CompatiblePSEditions = @(... | module / manifest / collector helper block |
| 2026-04-16T17:00:55.2473216-07:00 | background | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-Windows Defender/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) { [PSCustomObject]... | module / manifest / collector helper block |
Correlated Timeline
| Minute | Likely User | Background | DNS | Network |
|---|---|---|---|---|
| 2026-04-16T17:00:00-07:00 | Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs || Registry change (CreateKey) HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates || Registry change (... | |||
| 2026-04-16T13:50:00-07:00 | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} || conhost.exe <= hp-plugin-executor.exe | \??\C:\windows\system32\conhost.exe 0xffffffff -ForceV1 || hp-p... | |||
| 2026-04-16T14:15:00-07:00 | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca || chrome.exe <= chrome.exe | "C:\Program Files\Google\... | |||
| 2026-04-16T16:54:00-07:00 | Taskmgr.exe <= explorer.exe | "C:\windows\system32\taskmgr.exe" /4 | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding || CHXSmartScreen.exe <= svchost.exe | "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe" -Serv... | ||
| 2026-04-16T15:17:00-07:00 | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} || $global:? || { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventD... | |||
| 2026-04-16T15:38:00-07:00 | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... || @{ GUID="CA046F10-CA64-4740-8FF9... | |||
| 2026-04-16T15:27:00-07:00 | $ErrorActionPreference = 'Stop' $logName = 'Microsoft-Windows-PowerShell/Operational' $start = (Get-Date).AddDays(-2) if (-not (Get-WinEvent -ListLog $logName -ErrorAction Silen... || powershell.exe <= python.exe | C:... | |||
| 2026-04-16T14:06:00-07:00 | ipconfig.exe <= powershell.exe | "C:\windows\system32\ipconfig.exe" /all || ipconfig /all || schtasks.exe <= powershell.exe | "C:\windows\system32\schtasks.exe" /query || schtasks /query || reg.exe <= powershell.exe |... | sppsvc.exe <= services.exe | C:\windows\system32\sppsvc.exe || prompt || prompt || prompt || backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccou... | ||
| 2026-04-16T14:07:00-07:00 | reg.exe <= powershell.exe | "C:\windows\system32\reg.exe" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v IRTestRun /f || reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v IRTestRun /f ||... | prompt || prompt || prompt || prompt || prompt || prompt | ||
| 2026-04-16T14:05:00-07:00 | Invoke-WebRequest -Uri "https://example.com" -OutFile "$env:USERPROFILE\Desktop\example_test.html" || cmd.exe <= powershell.exe | "C:\windows\system32\cmd.exe" /c echo test-from-cmd > "$env:USERPROFILE\Desktop\ir_test... | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} || SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGth... | ||
| 2026-04-16T13:30:00-07:00 | { $xml = [xml]$_.ToXml() $data = [ordered]@{} foreach ($d in $xml.Event.EventData.Data) { $key = if ($d.Name) { [string]$d.Name } else { 'Data' } $value ... || @{ GUID="CA046F10-CA64-4740-8FF9... | |||
| 2026-04-16T14:03:00-07:00 | Wireshark.exe <= explorer.exe | "C:\Program Files\Wireshark\Wireshark.exe" || Notepad.exe <= Notepad.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" ... | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding || backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProv... | ||
| 2026-04-16T16:45:00-07:00 | ai.exe <= WINWORD.EXE | "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "DD1E5E92-DC37-4A7D-84A1-7DB2CDD24AF5" "B5000976-3... || ai.exe <= WINWORD.EXE | "C:\Progr... | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca || chrome.exe <= chrome.exe | "C:\Program Files\Google\... | ||
| 2026-04-16T14:01:00-07:00 | bdtrackersnmh.exe <= cmd.exe | "C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe" chrome-extension://khndhdhbebhaddchcgnalcjlaekbbeof/ --parent-window=0 || cmd.exe <= chrome.exe | C:\windows\s... | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} || dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F590... | ||
| 2026-04-16T15:28:00-07:00 | chrome.exe <= chrome.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=passage_embeddings.mojom.PassageEmbeddingsService --lang=en-... || chrome.exe <= chrome.exe | "C:\Pr... | |||
| 2026-04-16T16:30:00-07:00 | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca || Code.exe <= Code.exe | "C:\Users\labuser\AppData\Local... | |||
| 2026-04-16T14:10:00-07:00 | Rename-Item "$env:USERPROFILE\Desktop\ir_file_test.txt" "ir_file_test_renamed.txt" || echo test > "$env:USERPROFILE\Desktop\ir_file_test.txt" | prompt || dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} || SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Gl... | ||
| 2026-04-16T14:00:00-07:00 | chrome.exe <= explorer.exe | "C:\Program Files\Google\Chrome\Application\chrome.exe" | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca || chrome.exe <= chrome.exe | "C:\Program Files\Google\... | ||
| 2026-04-16T15:52:00-07:00 | backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca || WmiPrvSE.exe <= svchost.exe | C:\windows\system32\wbem\wm... | |||
| 2026-04-16T13:27:00-07:00 | powershell.exe <= python.exe | C:\windows\System32\WindowsPowerShell\v1.0\powershell.EXE -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $logName =... || powershell.exe <= python.exe | C:... | |||
| 2026-04-16T13:10:00-07:00 | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding || backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProv... | |||
| 2026-04-16T16:38:00-07:00 | OfficeC2RClient.exe <= svchost.exe | "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False || RuntimeBroker.exe <= svchost.exe | C:\Windows\Sy... | |||
| 2026-04-16T15:39:00-07:00 | dllhost.exe <= svchost.exe | C:\windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} || SearchProtocolHost.exe <= SearchIndexer.exe | "C:\windows\System32\SearchProtocolHost.exe" Global\UsGth... | |||
| 2026-04-16T13:42:00-07:00 | Notepad.exe <= Notepad.exe | "C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2512.26.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe" "C:\Users\labuser\Desktop\Windows-IR-Lab\r... || Taskmgr.exe <= explorer.exe | "C:... | RuntimeBroker.exe <= svchost.exe | C:\Windows\System32\RuntimeBroker.exe -Embedding || backgroundTaskHost.exe <= svchost.exe | "C:\windows\system32\backgroundTaskHost.exe" -ServerName:AD2F1837.HPSupportAssistant.AppXp... | ||
| 2026-04-16T16:23:00-07:00 | SecurityHealthHost.exe <= svchost.exe | \\?\C:\Windows\System32\SecurityHealth\10.0.29554.1001-0\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding || RuntimeBroker.exe <= svchost.exe | C:\Window... |
High-Signal Process Findings
| Time | Score | Image | Parent | Command | Why Flagged |
|---|---|---|---|---|---|
| 2026-04-16T13:56:50.7141751-07:00 | 3 | C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe | C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}... | "C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe" -burn.clean.room="C:\ProgramData\Package Cache\{54E9... | Executed from a user/temp/downloads-type path; Parent process launched from suspicious path |
| 2026-04-16T13:56:50.7931555-07:00 | 3 | C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe | C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}... | "C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}\HPOneAgent.exe" -q -burn.elevated BurnPipe.{C5CE82A4-7EA8-4EF4-BCB7-... | Executed from a user/temp/downloads-type path; Parent process launched from suspicious path |
| 2026-04-16T13:56:52.2737414-07:00 | 3 | C:\ProgramData\Package Cache\20E2D7437367CB262CE45184EB4D809249FE654AA450D226E376D4057C... | C:\ProgramData\Package Cache\{54E95B92-D59B-4461-9FD4-863FE612A796}... | "C:\ProgramData\Package Cache\20E2D7437367CB262CE45184EB4D809249FE654AA450D226E376D4057C00B58E\vc_redist.x64.exe" -burn.embedded BurnPipe... | Executed from a user/temp/downloads-type path; Parent process launched from suspicious path |
| 2026-04-16T13:56:52.4775688-07:00 | 3 | C:\Windows\Temp\{215F1C21-273A-45A5-9082-9DEA74C518A9}\.cr\vc_redist.x64.exe | C:\ProgramData\Package Cache\20E2D7437367CB262CE45184EB4D809249FE65... | "C:\windows\Temp\{215F1C21-273A-45A5-9082-9DEA74C518A9}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\20E2D743736... | Executed from a user/temp/downloads-type path; Parent process launched from suspicious path |
| 2026-04-16T14:01:13.0255373-07:00 | 3 | C:\Windows\System32\cmd.exe | C:\Program Files\Google\Chrome\Application\chrome.exe | C:\windows\system32\cmd.exe /d /s /c ""C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackersnmh.exe" chrome-extension://khndhd... | LOLBin or script host: cmd.exe; Suspicious command line patterns |
PowerShell Findings
| Time | Event ID | Score | Matches | Preview |
|---|---|---|---|---|
| 2026-04-16T14:05:54.3257807-07:00 | 4104 | 2 | invoke-webrequest|\biwr\b | Invoke-WebRequest -Uri "https://example.com" -OutFile "$env:USERPROFILE\Desktop\example_test.html" |
AV Findings
No confirmed malware detections were identified from the collected review data.
Persistence Findings
No persistence entries were flagged by the current heuristics.
Browser Risks
| Time | Browser | Type | Score | Value | Context | Why Flagged |
|---|---|---|---|---|---|---|
| 2026-04-16T23:52:24.876090+00:00 | Chrome | download | 3 | C:\Users\labuser\Downloads\Windows Notepad Installer.exe | https://apps.microsoft.com/detail/9msmlrh6lzf3?hl=en-US&gl=US | Downloaded potentially risky file type; Downloaded to a user-controlled path |
| 2026-04-16T23:30:22.245224+00:00 | Chrome | download | 3 | C:\Users\labuser\Downloads\windows-ir-lab-github-preview.zip | https://chatgpt.com/c/69dfc601-414c-83e8-8d35-ae5ec39003a8 | Downloaded potentially risky file type; Downloaded to a user-controlled path |
| 2026-04-15T17:56:08.184605+00:00 | Chrome | download | 3 | C:\Users\labuser\Downloads\setup_windows_ir_workspace.ps1 | https://chatgpt.com/c/69dfc601-414c-83e8-8d35-ae5ec39003a8 | Downloaded potentially risky file type; Downloaded to a user-controlled path |
| 2026-04-15T17:53:27.333450+00:00 | Chrome | download | 4 | C:\Users\labuser\Downloads\SysinternalsSuite.zip | https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite?utm_source=chatgpt.com | Downloaded potentially risky file type; Downloaded to a user-controlled path; URL contains phishing/malware-ish terms |
Sysmon Network Summary
Top DNS Queries
| Query | Count |
|---|---|
| No data | |
Top Remote Targets
| Target | Count |
|---|---|
| No data | |
Suggested Next Manual Checks
- Start with Top 3 Findings and Likely User Actions before expanding background sections.
- Use the Correlated Timeline to align likely user actions with background activity and Sysmon DNS/network by minute.
- Use the activity-type filter and quick search to reduce noise during triage.
- If a URL or download looks suspicious, locate the corresponding process creation and any Sysmon DNS/network events around that minute.
- Validate persistence with Autoruns and live processes with Process Explorer/TCPView.
This report is heuristic and triage-oriented. Suppression in one section does not remove the event from the Full Raw Timeline or JSON output.